diff --git a/patterns/alz/policyDefinitions/policies-Automation.json b/patterns/alz/policyDefinitions/policies-Automation.json index c53be192b..46a17e72a 100644 --- a/patterns/alz/policyDefinitions/policies-Automation.json +++ b/patterns/alz/policyDefinitions/policies-Automation.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.29.47.4906", - "templateHash": "14892906486563466387" + "templateHash": "9851509082297596991" } }, "parameters": { @@ -115,7 +115,7 @@ "input": "[json(variables('processPolicySetDefinitionsAzureUSGovernment')[copyIndex('policySetDefinitionsAzureUSGovernment')])]" } ], - "$fxv#0": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_AA_TotalJob_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Automation Account TotalJob Alert\",\n \"description\": \"Policy to audit/deploy Automation Account TotalJob Alert\",\n \"metadata\": {\n \"version\": \"1.2.1\",\n \"category\": \"Automation\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"0\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Automation/automationAccounts\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Automation/automationAccounts\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"TotalJob\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Automation/automationAccounts/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-TotalJob-threshold-Override_'), field('tags._amba-TotalJob-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-TotalJob')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for Automation Account TotalJob Alert\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"TotalJob\",\n \"metricNamespace\": \"Microsoft.Automation/automationAccounts\",\n \"metricName\": \"TotalJob\",\n \"dimensions\": [\n {\n \"name\": \"Status\",\n \"operator\": \"Exclude\",\n \"values\": [\n \"Completed\"\n ]\n }\n ],\n \"operator\": \"GreaterThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-TotalJob-threshold-Override_'), field('tags._amba-TotalJob-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#0": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AA_TotalJob_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Automation Account TotalJob Alert\",\r\n \"description\": \"Policy to audit/deploy Automation Account TotalJob Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.1\",\r\n \"category\": \"Automation\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"0\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Automation/automationAccounts\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Automation/automationAccounts\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"TotalJob\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Automation/automationAccounts/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\r\n \"equals\": \"[[if(contains(field('tags'), '_amba-TotalJob-threshold-Override_'), field('tags._amba-TotalJob-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-TotalJob')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Automation Account TotalJob Alert\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"TotalJob\",\r\n \"metricNamespace\": \"Microsoft.Automation/automationAccounts\",\r\n \"metricName\": \"TotalJob\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Status\",\r\n \"operator\": \"Exclude\",\r\n \"values\": [\r\n \"Completed\"\r\n ]\r\n }\r\n ],\r\n \"operator\": \"GreaterThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[if(contains(field('tags'), '_amba-TotalJob-threshold-Override_'), field('tags._amba-TotalJob-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", "cloudEnv": "[environment().name]", "defaultDeploymentLocationByCloudType": { "AzureCloud": "northeurope", diff --git a/patterns/alz/policyDefinitions/policies-Compute.json b/patterns/alz/policyDefinitions/policies-Compute.json index ab9c91b69..103a55572 100644 --- a/patterns/alz/policyDefinitions/policies-Compute.json +++ b/patterns/alz/policyDefinitions/policies-Compute.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.29.47.4906", - "templateHash": "2594528588773992845" + "templateHash": "5051039695392476304" } }, "parameters": { @@ -115,9 +115,9 @@ "input": "[json(variables('processPolicySetDefinitionsAzureUSGovernment')[copyIndex('policySetDefinitionsAzureUSGovernment')])]" } ], - "$fxv#0": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_dataDiskReadLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM Data Disk Read Latency Alert\",\n \"description\": \"Policy to audit/deploy VM dataDiskReadLatency Alert\",\n \"metadata\": {\n \"version\": \"1.4.1\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMHighDataDiskReadLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMdataDiskReadLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMHighDataDiskReadLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighDataDiskReadLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine dataDiskReadLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#1": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_dataDiskSpace_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM Data Disk Space Alert\",\n \"description\": \"Policy to audit/deploy VM data Disk Space Alert\",\n \"metadata\": {\n \"version\": \"1.4.1\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMLowDataDiskSpaceAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMdataDiskSpaceAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMLowDataDiskSpaceAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMLowDataDiskSpaceAlert')]\",\n \"description\": \"Log Alert for Virtual Machine dataDiskSpace\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#10": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_Memory_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM Memory Alert\",\n \"description\": \"Policy to audit/deploy VM Memory Alert\",\n \"metadata\": {\n \"version\": \"1.4.1\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMLowMemoryAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\" | extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMMemoryAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMLowMemoryAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMLowMemoryAlert')]\",\n \"description\": \"Log Alert for Virtual Machine Memory\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\" | extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#0": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_dataDiskReadLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM Data Disk Read Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM dataDiskReadLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.4.1\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"30\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMHighDataDiskReadLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMdataDiskReadLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMHighDataDiskReadLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighDataDiskReadLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine dataDiskReadLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#1": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_dataDiskSpace_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM Data Disk Space Alert\",\r\n \"description\": \"Policy to audit/deploy VM data Disk Space Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.1\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMLowDataDiskSpaceAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMdataDiskSpaceAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMLowDataDiskSpaceAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMLowDataDiskSpaceAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine dataDiskSpace\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#10": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_Memory_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM Memory Alert\",\r\n \"description\": \"Policy to audit/deploy VM Memory Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.4.1\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMLowMemoryAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\" | extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMMemoryAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMLowMemoryAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMLowMemoryAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine Memory\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\" | extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", "$fxv#11": { "type": "Microsoft.Authorization/policySetDefinitions", "apiVersion": "2021-06-01", @@ -126,7 +126,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Virtual Machines", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Azure Virtual Machines.", "metadata": { - "version": "1.0.0", + "version": "1.1.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -2511,14 +2511,14 @@ "policyDefinitionGroups": null } }, - "$fxv#2": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_dataDiskWriteLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM Data Disk Write Latency Alert\",\n \"description\": \"Policy to audit/deploy VM dataDiskWriteLatency Alert\",\n \"metadata\": {\n \"version\": \"1.4.1\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMHighDataDiskWriteLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMdataDiskWriteLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMHighDataDiskWriteLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighDataDiskWriteLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine dataDiskWriteLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#3": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_HeartBeat_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM HeartBeat Alert\",\n \"description\": \"Policy to audit/deploy VM HeartBeat Alert for all VMs in the subscription\",\n \"metadata\": {\n \"version\": \"1.4.1\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"1\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT6H\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMHeartBeatAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-Heartbeat-threshold-Override_\\\"); Heartbeat | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\\\"minute\\\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-Heartbeat-threshold-Override_\\\", tostring(tags.[\\\"_amba-Heartbeat-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HeartBeatAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMHeartBeatAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMHeartBeatAlert')]\",\n \"description\": \"Log Alert for Virtual Machine Heartbeat\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-Heartbeat-threshold-Override_\\\"); Heartbeat | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\\\"minute\\\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-Heartbeat-threshold-Override_\\\", tostring(tags.[\\\"_amba-Heartbeat-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#4": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_NetworkIn_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM Network Read Alert\",\n \"description\": \"Policy to audit/deploy VM Network Read Alert\",\n \"metadata\": {\n \"version\": \"1.4.1\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10000000\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMHighNetworkInAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMNetworkInAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMHighNetworkInAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighNetworkInAlert')]\",\n \"description\": \"Log Alert for Virtual Machine NetworkIn\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"NetworkInterface\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#5": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_NetworkOut_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM Network Write Alert\",\n \"description\": \"Policy to audit/deploy VM Network Out Alert\",\n \"metadata\": {\n \"version\": \"1.4.1\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10000000\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMHighNetworkOutAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMNetworkOutAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMHighNetworkOutAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighNetworkOutAlert')]\",\n \"description\": \"Log Alert for Virtual Machine NetworkOut\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"NetworkInterface\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#6": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_OSDiskreadLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM OS Disk Read Latency Alert\",\n \"description\": \"Policy to audit/deploy VM OSDiskreadLatency Alert\",\n \"metadata\": {\n \"version\": \"1.4.1\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMHighOSDiskReadLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMOSDiskreadLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMHighOSDiskReadLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighOSDiskReadLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine OSDiskreadLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#7": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_OSDiskSpace_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM OS Disk Space Alert\",\n \"description\": \"Policy to audit/deploy VM OSDiskSpace Alert\",\n \"metadata\": {\n \"version\": \"1.4.1\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMLowOSDiskSpaceAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMOSDiskSpaceAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMLowOSDiskSpaceAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMLowOSDiskSpaceAlert')]\",\n \"description\": \"Log Alert for Virtual Machine OSDiskSpace\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#8": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_OSDiskwriteLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM OS Disk Write Latency Alert\",\n \"description\": \"Policy to audit/deploy VM OSDiskwriteLatency Alert\",\n \"metadata\": {\n \"version\": \"1.4.1\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMHighOSDiskWriteLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMOSDiskwriteLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMHighOSDiskWriteLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighOSDiskWriteLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine OSDiskwriteLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#9": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_CPU_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM CPU Alert\",\n \"description\": \"Policy to audit/deploy VM CPU Alert\",\n \"metadata\": {\n \"version\": \"1.4.1\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"85\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMHighCPUAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-UtilizationPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMCPUAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMHighCPUAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighCPUAlert')]\",\n \"description\": \"Log Alert for Virtual Machine CPU\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-UtilizationPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#2": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_dataDiskWriteLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM Data Disk Write Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM dataDiskWriteLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.4.1\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"30\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMHighDataDiskWriteLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMdataDiskWriteLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMHighDataDiskWriteLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighDataDiskWriteLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine dataDiskWriteLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#3": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_HeartBeat_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM HeartBeat Alert\",\r\n \"description\": \"Policy to audit/deploy VM HeartBeat Alert for all VMs in the subscription\",\r\n \"metadata\": {\r\n \"version\": \"1.4.1\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"1\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT6H\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMHeartBeatAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-Heartbeat-threshold-Override_\\\"); Heartbeat | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\\\"minute\\\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-Heartbeat-threshold-Override_\\\", tostring(tags.[\\\"_amba-Heartbeat-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HeartBeatAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMHeartBeatAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMHeartBeatAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine Heartbeat\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-Heartbeat-threshold-Override_\\\"); Heartbeat | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\\\"minute\\\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-Heartbeat-threshold-Override_\\\", tostring(tags.[\\\"_amba-Heartbeat-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#4": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_NetworkIn_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM Network Read Alert\",\r\n \"description\": \"Policy to audit/deploy VM Network Read Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.4.1\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10000000\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMHighNetworkInAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMNetworkInAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMHighNetworkInAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighNetworkInAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine NetworkIn\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"NetworkInterface\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#5": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_NetworkOut_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM Network Write Alert\",\r\n \"description\": \"Policy to audit/deploy VM Network Out Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.4.1\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10000000\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMHighNetworkOutAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMNetworkOutAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMHighNetworkOutAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighNetworkOutAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine NetworkOut\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"NetworkInterface\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#6": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_OSDiskreadLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM OS Disk Read Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM OSDiskreadLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.4.1\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"30\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMHighOSDiskReadLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMOSDiskreadLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMHighOSDiskReadLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighOSDiskReadLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine OSDiskreadLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#7": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_OSDiskSpace_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM OS Disk Space Alert\",\r\n \"description\": \"Policy to audit/deploy VM OSDiskSpace Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.4.1\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMLowOSDiskSpaceAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMOSDiskSpaceAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMLowOSDiskSpaceAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMLowOSDiskSpaceAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine OSDiskSpace\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#8": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_OSDiskwriteLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM OS Disk Write Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM OSDiskwriteLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.4.1\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"30\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMHighOSDiskWriteLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMOSDiskwriteLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMHighOSDiskWriteLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighOSDiskWriteLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine OSDiskwriteLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#9": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_CPU_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM CPU Alert\",\r\n \"description\": \"Policy to audit/deploy VM CPU Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.4.1\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"85\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMHighCPUAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-UtilizationPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMCPUAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMHighCPUAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighCPUAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine CPU\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-UtilizationPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", "cloudEnv": "[environment().name]", "defaultDeploymentLocationByCloudType": { "AzureCloud": "northeurope", diff --git a/patterns/alz/policyDefinitions/policies-Hybrid.json b/patterns/alz/policyDefinitions/policies-Hybrid.json index e0e479557..1c484e548 100644 --- a/patterns/alz/policyDefinitions/policies-Hybrid.json +++ b/patterns/alz/policyDefinitions/policies-Hybrid.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.29.47.4906", - "templateHash": "7697697196028043788" + "templateHash": "6714285646242220320" } }, "parameters": { @@ -115,10 +115,10 @@ "input": "[json(variables('processPolicySetDefinitionsAzureUSGovernment')[copyIndex('policySetDefinitionsAzureUSGovernment')])]" } ], - "$fxv#0": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_dataDiskReadLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Data Disk Read Latency Alert\",\n \"description\": \"Policy to audit/deploy VM dataDiskReadLatency Alert\",\n \"metadata\": {\n \"version\": \"1.2.1\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskReadLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMdataDiskReadLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskReadLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskReadLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine dataDiskReadLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#1": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_dataDiskSpace_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Data Disk Space Alert\",\n \"description\": \"Policy to audit/deploy VM data Disk Space Alert\",\n \"metadata\": {\n \"version\": \"1.2.1\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMLowDataDiskSpaceAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMdataDiskSpaceAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMLowDataDiskSpaceAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMLowDataDiskSpaceAlert')]\",\n \"description\": \"Log Alert for Virtual Machine dataDiskSpace\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#10": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_Memory_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Memory Alert\",\n \"description\": \"Policy to audit/deploy VM Memory Alert\",\n \"metadata\": {\n \"version\": \"1.2.1\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMLowMemoryAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\" | extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMMemoryAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMLowMemoryAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMLowMemoryAlert')]\",\n \"description\": \"Log Alert for Virtual Machine Memory\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\" | extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#11": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_Disconnected_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Disconnected Alert\",\n \"description\": \"Policy to Deploy Hybrid VM Disconnected Alert\",\n \"metadata\": {\n \"version\": \"1.4.0\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"1\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"P1D\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT10M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT2H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT10M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"defaultValue\": \"10m\",\n \"allowedValues\": [\n \"5m\",\n \"10m\",\n \"15m\",\n \"30m\",\n \"1h\",\n \"2h\",\n \"3h\",\n \"6h\",\n \"12h\",\n \"1d\",\n \"2d\",\n \"3d\",\n \"7d\"\n ],\n \"metadata\": {\n \"displayName\": \"Hybrid VM Disconnected Threshold (expressed in timespan)\",\n \"description\": \"Threshold in timespan value for the Hybrid VM Disconnected alert\"\n }\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMDisconnectedAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | where parse_json(tostring(tags.{0})) !in~ (\\\"{1}\\\") | where tostring(properties.status) == \\\"Disconnected\\\" | extend lastContactedDate = todatetime(properties.lastStatusChange) | where lastContactedDate <= ago(totimespan(policyThresholdString)) | extend status = tostring(properties.status) | project id, Computer=name, status, lastContactedDate', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMDisconnectedAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMDisconnectedAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMDisconnectedAlert')]\",\n \"description\": \"Hybrid VM in disconnected state. Not being connected, prevents extensions to be correctly managed from the portal and Azure policies to be correctly applied. Ensure that both server the specific service (Azure Hybrid Instance Metadata Service on Windows or azcmagent on Linux) are running.\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | where parse_json(tostring(tags.{0})) !in~ (\\\"{1}\\\") | where tostring(properties.status) == \\\"Disconnected\\\" | extend lastContactedDate = todatetime(properties.lastStatusChange) | where lastContactedDate <= ago(totimespan(policyThresholdString)) | extend status = tostring(properties.status) | project id, Computer=name, status, lastContactedDate', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"resourceIdColumn\": \"id\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#0": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_dataDiskReadLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Data Disk Read Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM dataDiskReadLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.4.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"30\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskReadLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMdataDiskReadLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskReadLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskReadLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine dataDiskReadLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#1": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_dataDiskSpace_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Data Disk Space Alert\",\r\n \"description\": \"Policy to audit/deploy VM data Disk Space Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMLowDataDiskSpaceAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMdataDiskSpaceAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMLowDataDiskSpaceAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMLowDataDiskSpaceAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine dataDiskSpace\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#10": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_Memory_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Memory Alert\",\r\n \"description\": \"Policy to audit/deploy VM Memory Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMLowMemoryAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\" | extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMMemoryAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMLowMemoryAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMLowMemoryAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine Memory\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\" | extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#11": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_Disconnected_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Disconnected Alert\",\r\n \"description\": \"Policy to Deploy Hybrid VM Disconnected Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.4.0\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"1\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"P1D\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT10M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT2H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT10M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"defaultValue\": \"10m\",\r\n \"allowedValues\": [\r\n \"5m\",\r\n \"10m\",\r\n \"15m\",\r\n \"30m\",\r\n \"1h\",\r\n \"2h\",\r\n \"3h\",\r\n \"6h\",\r\n \"12h\",\r\n \"1d\",\r\n \"2d\",\r\n \"3d\",\r\n \"7d\"\r\n ],\r\n \"metadata\": {\r\n \"displayName\": \"Hybrid VM Disconnected Threshold (expressed in timespan)\",\r\n \"description\": \"Threshold in timespan value for the Hybrid VM Disconnected alert\"\r\n }\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMDisconnectedAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | where parse_json(tostring(tags.{0})) !in~ (\\\"{1}\\\") | where tostring(properties.status) == \\\"Disconnected\\\" | extend lastContactedDate = todatetime(properties.lastStatusChange) | where lastContactedDate <= ago(totimespan(policyThresholdString)) | extend status = tostring(properties.status) | project id, Computer=name, status, lastContactedDate', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMDisconnectedAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMDisconnectedAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMDisconnectedAlert')]\",\r\n \"description\": \"Hybrid VM in disconnected state. Not being connected, prevents extensions to be correctly managed from the portal and Azure policies to be correctly applied. Ensure that both server the specific service (Azure Hybrid Instance Metadata Service on Windows or azcmagent on Linux) are running.\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | where parse_json(tostring(tags.{0})) !in~ (\\\"{1}\\\") | where tostring(properties.status) == \\\"Disconnected\\\" | extend lastContactedDate = todatetime(properties.lastStatusChange) | where lastContactedDate <= ago(totimespan(policyThresholdString)) | extend status = tostring(properties.status) | project id, Computer=name, status, lastContactedDate', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"resourceIdColumn\": \"id\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", "$fxv#12": { "type": "Microsoft.Authorization/policySetDefinitions", "apiVersion": "2021-06-01", @@ -127,7 +127,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Hybrid VMs", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Azure Arc-enabled Servers.", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -2700,14 +2700,14 @@ "policyDefinitionGroups": null } }, - "$fxv#2": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_dataDiskWriteLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Data Disk Write Latency Alert\",\n \"description\": \"Policy to audit/deploy VM dataDiskWriteLatency Alert\",\n \"metadata\": {\n \"version\": \"1.2.1\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskWriteLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMdataDiskWriteLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskWriteLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskWriteLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine dataDiskWriteLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#3": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_HeartBeat_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM HeartBeat Alert\",\n \"description\": \"Policy to audit/deploy VM HeartBeat Alert for all VMs in the subscription\",\n \"metadata\": {\n \"version\": \"1.2.1\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"1\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT6H\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHeartBeatAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-Heartbeat-threshold-Override_\\\"); Heartbeat | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\\\"minute\\\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-Heartbeat-threshold-Override_\\\", tostring(tags.[\\\"_amba-Heartbeat-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMHeartBeatAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHeartBeatAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHeartBeatAlert')]\",\n \"description\": \"Log Alert for Virtual Machine Heartbeat\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-Heartbeat-threshold-Override_\\\"); Heartbeat | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\\\"minute\\\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-Heartbeat-threshold-Override_\\\", tostring(tags.[\\\"_amba-Heartbeat-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#4": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_NetworkIn_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Network Read Alert\",\n \"description\": \"Policy to audit/deploy VM Nework Read Alert\",\n \"metadata\": {\n \"version\": \"1.2.1\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10000000\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkInAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMVMNetworkInAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkInAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkInAlert')]\",\n \"description\": \"Log Alert for Virtual Machine NetworkIn\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"NetworkInterface\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#5": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_NetworkOut_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Network Write Alert\",\n \"description\": \"Policy to audit/deploy VM Network Out Alert\",\n \"metadata\": {\n \"version\": \"1.2.1\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10000000\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkOutAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMVMNetworkOutAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkOutAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkOutAlert')]\",\n \"description\": \"Log Alert for Virtual Machine NetworkOut\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"NetworkInterface\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#6": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_OSDiskreadLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM OS Disk Read Latency Alert\",\n \"description\": \"Policy to audit/deploy VM OSDiskreadLatency Alert\",\n \"metadata\": {\n \"version\": \"1.2.1\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskReadLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMOSDiskreadLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskReadLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskReadLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine OSDiskreadLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#7": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_OSDiskSpace_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM OS Disk Space Alert\",\n \"description\": \"Policy to audit/deploy VM OSDiskSpace Alert\",\n \"metadata\": {\n \"version\": \"1.2.1\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskSpaceAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMOSDiskSpaceAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskSpaceAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskSpaceAlert')]\",\n \"description\": \"Log Alert for Virtual Machine OSDiskSpace\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#8": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_OSDiskwriteLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM OS Disk Write Latency Alert\",\n \"description\": \"Policy to audit/deploy VM OSDiskwriteLatency Alert\",\n \"metadata\": {\n \"version\": \"1.2.1\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskWriteLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMOSDiskwriteLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskWriteLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskWriteLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine OSDiskwriteLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#9": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_CPU_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM CPU Alert\",\n \"description\": \"Policy to audit/deploy VM CPU Alert\",\n \"metadata\": {\n \"version\": \"1.2.1\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"85\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighCPUAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-UtilizationPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMCPUAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighCPUAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighCPUAlert')]\",\n \"description\": \"Log Alert for Virtual Machine CPU\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-UtilizationPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#2": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_dataDiskWriteLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Data Disk Write Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM dataDiskWriteLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"30\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskWriteLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMdataDiskWriteLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskWriteLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskWriteLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine dataDiskWriteLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#3": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_HeartBeat_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM HeartBeat Alert\",\r\n \"description\": \"Policy to audit/deploy VM HeartBeat Alert for all VMs in the subscription\",\r\n \"metadata\": {\r\n \"version\": \"1.2.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"1\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT6H\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHeartBeatAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-Heartbeat-threshold-Override_\\\"); Heartbeat | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\\\"minute\\\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-Heartbeat-threshold-Override_\\\", tostring(tags.[\\\"_amba-Heartbeat-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMHeartBeatAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHeartBeatAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHeartBeatAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine Heartbeat\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-Heartbeat-threshold-Override_\\\"); Heartbeat | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\\\"minute\\\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-Heartbeat-threshold-Override_\\\", tostring(tags.[\\\"_amba-Heartbeat-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#4": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_NetworkIn_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Network Read Alert\",\r\n \"description\": \"Policy to audit/deploy VM Nework Read Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10000000\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkInAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMVMNetworkInAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkInAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkInAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine NetworkIn\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"NetworkInterface\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#5": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_NetworkOut_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Network Write Alert\",\r\n \"description\": \"Policy to audit/deploy VM Network Out Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10000000\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkOutAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMVMNetworkOutAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkOutAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkOutAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine NetworkOut\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"NetworkInterface\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#6": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_OSDiskreadLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM OS Disk Read Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM OSDiskreadLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"30\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskReadLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMOSDiskreadLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskReadLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskReadLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine OSDiskreadLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#7": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_OSDiskSpace_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM OS Disk Space Alert\",\r\n \"description\": \"Policy to audit/deploy VM OSDiskSpace Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskSpaceAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMOSDiskSpaceAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskSpaceAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskSpaceAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine OSDiskSpace\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#8": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_OSDiskwriteLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM OS Disk Write Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM OSDiskwriteLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.8.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"30\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskWriteLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMOSDiskwriteLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskWriteLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskWriteLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine OSDiskwriteLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#9": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_CPU_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM CPU Alert\",\r\n \"description\": \"Policy to audit/deploy VM CPU Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"85\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighCPUAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-UtilizationPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMCPUAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighCPUAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighCPUAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine CPU\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-UtilizationPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", "cloudEnv": "[environment().name]", "defaultDeploymentLocationByCloudType": { "AzureCloud": "northeurope", diff --git a/patterns/alz/policyDefinitions/policies-KeyManagement.json b/patterns/alz/policyDefinitions/policies-KeyManagement.json index f00db9384..831f4fd9e 100644 --- a/patterns/alz/policyDefinitions/policies-KeyManagement.json +++ b/patterns/alz/policyDefinitions/policies-KeyManagement.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.29.47.4906", - "templateHash": "10499038651207382897" + "templateHash": "6289541930037469982" } }, "parameters": { @@ -131,7 +131,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Key Management", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Key Management Services such as Azure Key Vault, and Managed HSM.", "metadata": { - "version": "1.0.0", + "version": "1.2.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -921,7 +921,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Identity", "description": "Initiative to deploy AMBA alerts relevant to the ALZ Identity management group", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policyDefinitions/policies-Network.json b/patterns/alz/policyDefinitions/policies-Network.json index 34a0dca5e..2ecd8b0da 100644 --- a/patterns/alz/policyDefinitions/policies-Network.json +++ b/patterns/alz/policyDefinitions/policies-Network.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.29.47.4906", - "templateHash": "7806782844238847877" + "templateHash": "3142017541358409717" } }, "parameters": { @@ -148,20 +148,20 @@ "$fxv#36": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VPNGw_Ingress_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VPNG Ingress Alert\",\r\n \"description\": \"Policy to audit/deploy VPN Gateway Ingress Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"0\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"microsoft.network/vpngateways\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"microsoft.network/vpngateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"tunnelingressbytes\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.network/vpngateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\r\n \"equals\": \"[[if(contains(field('tags'), '_amba-tunnelingressbytes-threshold-Override_'), field('tags._amba-tunnelingressbytes-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelIngressAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for VPN Gateway tunnel ingress bytes\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"tunnelingressbytes\",\r\n \"metricNamespace\": \"microsoft.network/vpngateways\",\r\n \"metricName\": \"tunnelingressbytes\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[if(contains(field('tags'), '_amba-tunnelingressbytes-threshold-Override_'), field('tags._amba-tunnelingressbytes-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", "$fxv#37": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VPNGw_TunnelIngressPacketDropCount_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VPNG Ingress Packet Drop Count Alert\",\r\n \"description\": \"Policy to audit/deploy VPN Gateway Ingress Packet Drop Count Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.3.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"3\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"4\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"4\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"microsoft.network/vpngateways\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"microsoft.network/vpngateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"TunnelIngressPacketDropCount\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.network/vpngateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelIngressPacketDropCountAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for VPN Gateway tunnel TunnelIngressPacketDropCount\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"name\": \"TunnelIngressPacketDropCount\",\r\n \"metricNamespace\": \"microsoft.network/vpngateways\",\r\n \"metricName\": \"TunnelIngressPacketDropCount\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", "$fxv#38": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VPNGw_TunnelIngressPacketDropMismatch_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VPNG Ingress Packet Drop Mismatch Alert\",\r\n \"description\": \"Policy to audit/deploy VPN Gateway Ingress Packet Drop Mismatch Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.3.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"3\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"4\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"4\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"microsoft.network/vpngateways\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"microsoft.network/vpngateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"TunnelIngressPacketDropTSMismatch\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.network/vpngateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelIngressPacketDropTSMismatchAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for VPN Gateway tunnel TunnelIngressPacketDropTSMismatch\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"name\": \"TunnelIngressPacketDropTSMismatch\",\r\n \"metricNamespace\": \"microsoft.network/vpngateways\",\r\n \"metricName\": \"TunnelIngressPacketDropTSMismatch\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#39": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AG_ApplicationGatewayTotalTime_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy AGW ApplicationGatewayTotalTime Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Application Gateway ApplicationGatewayTotalTime Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.4.0\",\r\n \"Category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"alertSensitivity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert Sensitivity\",\r\n \"description\": \"Alert Sensitivity for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"Low\",\r\n \"Medium\",\r\n \"High\"\r\n ],\r\n \"defaultValue\": \"Medium\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/applicationgateways/sku.name\",\r\n \"In\": [\r\n \"Standard_v2\",\r\n \"WAF_v2\"\r\n ]\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"ApplicationGatewayTotalTime\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"alertSensitivity\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-agApplicationGatewayTotalTime')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for App Gateway ApplicationGatewayTotalTime\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"ApplicationGatewayTotalTime\",\r\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\r\n \"metricName\": \"ApplicationGatewayTotalTime\",\r\n \"operator\": \"GreaterThan\",\r\n \"alertSensitivity\": \"[[parameters('alertSensitivity')]\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"alertSensitivity\": {\r\n \"value\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"alertSensitivity\": {\r\n \"value\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#39": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AG_ApplicationGatewayTotalTime_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy AGW ApplicationGatewayTotalTime Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Application Gateway ApplicationGatewayTotalTime Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.5.0\",\r\n \"Category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"alertSensitivity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert Sensitivity\",\r\n \"description\": \"Alert Sensitivity for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"Low\",\r\n \"Medium\",\r\n \"High\"\r\n ],\r\n \"defaultValue\": \"Medium\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/applicationgateways/sku.name\",\r\n \"In\": [\r\n \"Standard_v2\",\r\n \"WAF_v2\"\r\n ]\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"ApplicationGatewayTotalTime\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"alertSensitivity\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-agApplicationGatewayTotalTime')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for App Gateway ApplicationGatewayTotalTime\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"ApplicationGatewayTotalTime\",\r\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\r\n \"metricName\": \"ApplicationGatewayTotalTime\",\r\n \"operator\": \"GreaterThan\",\r\n \"alertSensitivity\": \"[[parameters('alertSensitivity')]\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"alertSensitivity\": {\r\n \"value\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"alertSensitivity\": {\r\n \"value\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", "$fxv#4": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_ERCIR_BgpAvailability_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy ExpressRoute Circuits Bgp Availability Alert\",\r\n \"description\": \"Policy to audit/deploy ExpressRoute Circuits Bgp Availability Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"0\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"90\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/expressRouteCircuits\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/expressRouteCircuits\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"BgpAvailability\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressRouteCircuits/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[if(contains(field('tags'), '_amba-BgpAvailability-threshold-Override_'), field('tags._amba-BgpAvailability-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-BgpAvailability')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for ExpressRoute Circuit Bgp Availability\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"BgpAvailability\",\r\n \"metricNamespace\": \"Microsoft.Network/expressRouteCircuits\",\r\n \"metricName\": \"BgpAvailability\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[if(contains(field('tags'), '_amba-BgpAvailability-threshold-Override_'), field('tags._amba-BgpAvailability-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#40": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AG_BackendLastByteResponseTime_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy AGW BackendLastByteResponseTime Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Application Gateway BackendLastByteResponseTime Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.4.0\",\r\n \"Category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"alertSensitivity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert Sensitivity\",\r\n \"description\": \"Alert Sensitivity for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"Low\",\r\n \"Medium\",\r\n \"High\"\r\n ],\r\n \"defaultValue\": \"Medium\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/applicationgateways/sku.name\",\r\n \"In\": [\r\n \"Standard_v2\",\r\n \"WAF_v2\"\r\n ]\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"BackendLastByteResponseTime\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"alertSensitivity\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-agBackendLastByteResponseTime')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for App Gateway BackendLastByteResponseTime\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"BackendLastByteResponseTime\",\r\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\r\n \"metricName\": \"BackendLastByteResponseTime\",\r\n \"operator\": \"GreaterThan\",\r\n \"alertSensitivity\": \"[[parameters('alertSensitivity')]\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"alertSensitivity\": {\r\n \"value\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"alertSensitivity\": {\r\n \"value\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#41": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AG_CapacityUnits_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy AGW Capacity Units Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Application Gateway CapacityUnits Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"Category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"75\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/applicationgateways/sku.name\",\r\n \"In\": [\r\n \"Standard_v2\",\r\n \"WAF_v2\"\r\n ]\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"CapacityUnits\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[if(contains(field('tags'), '_amba-CapacityUnits-threshold-Override_'), field('tags._amba-CapacityUnits-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-agCapacityUnits')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for App Gateway Capacity Units\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"CapacityUnits\",\r\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\r\n \"metricName\": \"CapacityUnits\",\r\n \"operator\": \"GreaterThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[if(contains(field('tags'), '_amba-CapacityUnits-threshold-Override_'), field('tags._amba-CapacityUnits-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#42": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AG_ComputeUnits_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy AGW Compute Units Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Application Gateway ComputeUnits Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"Category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"75\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/applicationgateways/sku.name\",\r\n \"In\": [\r\n \"Standard_v2\",\r\n \"WAF_v2\"\r\n ]\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"ComputeUnits\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[if(contains(field('tags'), '_amba-ComputeUnits-threshold-Override_'), field('tags._amba-ComputeUnits-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-agComputeUnits')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for App Gateway Compute Units\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"ComputeUnits\",\r\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\r\n \"metricName\": \"ComputeUnits\",\r\n \"operator\": \"GreaterThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[if(contains(field('tags'), '_amba-ComputeUnits-threshold-Override_'), field('tags._amba-ComputeUnits-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#43": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AG_CPUUtilization_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy AGW CPU Utilization Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Application Gateway CPU Utilization Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"Category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"80\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/applicationgateways/sku.name\",\r\n \"notIn\": [\r\n \"Standard_v2\",\r\n \"WAF_v2\"\r\n ]\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"CpuUtilization\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[if(contains(field('tags'), '_amba-CpuUtilization-threshold-Override_'), field('tags._amba-CpuUtilization-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-agCpuUtilization')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for App Gateway CPU Utilization\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"CpuUtilization\",\r\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\r\n \"metricName\": \"CpuUtilization\",\r\n \"operator\": \"GreaterThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[if(contains(field('tags'), '_amba-CpuUtilization-threshold-Override_'), field('tags._amba-CpuUtilization-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#44": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AG_FailedRequests_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy AGW FailedRequests Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Application Gateway FailedRequests Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.3.0\",\r\n \"Category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"alertSensitivity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert Sensitivity\",\r\n \"description\": \"Alert Sensitivity for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"Low\",\r\n \"Medium\",\r\n \"High\"\r\n ],\r\n \"defaultValue\": \"Medium\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"FailedRequests\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Total\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"alertSensitivity\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-agFailedRequests')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for App Gateway FailedRequests\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"FailedRequests\",\r\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\r\n \"metricName\": \"FailedRequests\",\r\n \"operator\": \"GreaterThan\",\r\n \"alertSensitivity\": \"[[parameters('alertSensitivity')]\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"timeAggregation\": \"Total\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"alertSensitivity\": {\r\n \"value\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"alertSensitivity\": {\r\n \"value\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#40": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AG_BackendLastByteResponseTime_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy AGW BackendLastByteResponseTime Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Application Gateway BackendLastByteResponseTime Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.5.0\",\r\n \"Category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"alertSensitivity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert Sensitivity\",\r\n \"description\": \"Alert Sensitivity for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"Low\",\r\n \"Medium\",\r\n \"High\"\r\n ],\r\n \"defaultValue\": \"Medium\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/applicationgateways/sku.name\",\r\n \"In\": [\r\n \"Standard_v2\",\r\n \"WAF_v2\"\r\n ]\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"BackendLastByteResponseTime\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"alertSensitivity\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-agBackendLastByteResponseTime')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for App Gateway BackendLastByteResponseTime\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"BackendLastByteResponseTime\",\r\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\r\n \"metricName\": \"BackendLastByteResponseTime\",\r\n \"operator\": \"GreaterThan\",\r\n \"alertSensitivity\": \"[[parameters('alertSensitivity')]\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"alertSensitivity\": {\r\n \"value\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"alertSensitivity\": {\r\n \"value\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#41": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AG_CapacityUnits_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy AGW Capacity Units Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Application Gateway CapacityUnits Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.4.0\",\r\n \"Category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"75\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/applicationgateways/sku.name\",\r\n \"In\": [\r\n \"Standard_v2\",\r\n \"WAF_v2\"\r\n ]\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"CapacityUnits\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[if(contains(field('tags'), '_amba-CapacityUnits-threshold-Override_'), field('tags._amba-CapacityUnits-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-agCapacityUnits')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for App Gateway Capacity Units\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"CapacityUnits\",\r\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\r\n \"metricName\": \"CapacityUnits\",\r\n \"operator\": \"GreaterThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[if(contains(field('tags'), '_amba-CapacityUnits-threshold-Override_'), field('tags._amba-CapacityUnits-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#42": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AG_ComputeUnits_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy AGW Compute Units Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Application Gateway ComputeUnits Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.4.0\",\r\n \"Category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"75\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/applicationgateways/sku.name\",\r\n \"In\": [\r\n \"Standard_v2\",\r\n \"WAF_v2\"\r\n ]\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"ComputeUnits\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[if(contains(field('tags'), '_amba-ComputeUnits-threshold-Override_'), field('tags._amba-ComputeUnits-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-agComputeUnits')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for App Gateway Compute Units\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"ComputeUnits\",\r\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\r\n \"metricName\": \"ComputeUnits\",\r\n \"operator\": \"GreaterThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[if(contains(field('tags'), '_amba-ComputeUnits-threshold-Override_'), field('tags._amba-ComputeUnits-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#43": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AG_CPUUtilization_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy AGW CPU Utilization Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Application Gateway CPU Utilization Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.6.0\",\r\n \"Category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"80\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/applicationgateways/sku.name\",\r\n \"notIn\": [\r\n \"Standard_v2\",\r\n \"WAF_v2\"\r\n ]\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"CpuUtilization\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[if(contains(field('tags'), '_amba-CpuUtilization-threshold-Override_'), field('tags._amba-CpuUtilization-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-agCpuUtilization')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for App Gateway CPU Utilization\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"CpuUtilization\",\r\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\r\n \"metricName\": \"CpuUtilization\",\r\n \"operator\": \"GreaterThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[if(contains(field('tags'), '_amba-CpuUtilization-threshold-Override_'), field('tags._amba-CpuUtilization-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#44": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AG_FailedRequests_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy AGW FailedRequests Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Application Gateway FailedRequests Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.8.0\",\r\n \"Category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"alertSensitivity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert Sensitivity\",\r\n \"description\": \"Alert Sensitivity for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"Low\",\r\n \"Medium\",\r\n \"High\"\r\n ],\r\n \"defaultValue\": \"Medium\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"FailedRequests\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Total\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"alertSensitivity\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-agFailedRequests')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for App Gateway FailedRequests\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"FailedRequests\",\r\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\r\n \"metricName\": \"FailedRequests\",\r\n \"operator\": \"GreaterThan\",\r\n \"alertSensitivity\": \"[[parameters('alertSensitivity')]\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"timeAggregation\": \"Total\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"alertSensitivity\": {\r\n \"value\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"alertSensitivity\": {\r\n \"value\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", "$fxv#45": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AG_ResponseStatus_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy AGW ResponseStatus Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Application Gateway ResponseStatus Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.3.0\",\r\n \"Category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"alertSensitivity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert Sensitivity\",\r\n \"description\": \"Alert Sensitivity for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"Low\",\r\n \"Medium\",\r\n \"High\"\r\n ],\r\n \"defaultValue\": \"Medium\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"ResponseStatus\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Total\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"alertSensitivity\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-agResponseStatus')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for App Gateway ResponseStatus\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"ResponseStatus\",\r\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\r\n \"metricName\": \"ResponseStatus\",\r\n \"operator\": \"GreaterThan\",\r\n \"alertSensitivity\": \"[[parameters('alertSensitivity')]\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"timeAggregation\": \"Total\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"HttpStatusGroup\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"4xx\",\r\n \"5xx\"\r\n ]\r\n }\r\n ],\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"alertSensitivity\": {\r\n \"value\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"alertSensitivity\": {\r\n \"value\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", "$fxv#46": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AG_UnhealthyHostCount_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy AGW Unhealthy Host Count Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Application Gateway Unhealthy Host Count Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"Category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"20\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"UnhealthyHostCount\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[if(contains(field('tags'), '_amba-UnhealthyHostCount-threshold-Override_'), field('tags._amba-UnhealthyHostCount-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-agUnhealthyHostCount')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for App Gateway Unhealthy Host Count\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"CpuUtilization\",\r\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\r\n \"metricName\": \"UnhealthyHostCount\",\r\n \"operator\": \"GreaterThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[if(contains(field('tags'), '_amba-UnhealthyHostCount-threshold-Override_'), field('tags._amba-UnhealthyHostCount-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", "$fxv#47": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_TM_EndpointHealth_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Traffic Manager Endpoint Health Alert\",\r\n \"description\": \"Policy to audit/deploy FTraffic Manager Endpoint Health Health Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"Category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"0.9\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/trafficmanagerprofiles\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/trafficmanagerprofiles\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"ProbeAgentCurrentEndpointStateByProfileResourceId\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/trafficmanagerprofiles/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[if(contains(field('tags'), '_amba-EndpointHealth-threshold-Override_'), field('tags._amba-EndpointHealth-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-EndpointHealthAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Traffic Manager Endpoint Health\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"EndpointHealth\",\r\n \"metricNamespace\": \"Microsoft.Network/trafficmanagerprofiles\",\r\n \"metricName\": \"ProbeAgentCurrentEndpointStateByProfileResourceId\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"EndpointName\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ]\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[if(contains(field('tags'), '_amba-EndpointHealth-threshold-Override_'), field('tags._amba-EndpointHealth-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", "$fxv#48": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_FD_BackendHealth_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Frontdoor Backend Health Percentage Alert\",\r\n \"description\": \"Policy to audit/deploy FrontDoor Backend Health Percentage Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.1\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"90\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/frontdoors\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/frontdoors\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"BackendHealthPercentage\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/frontdoors/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[if(contains(field('tags'), '_amba-BackendHealthPercentage-threshold-Override_'), field('tags._amba-BackendHealthPercentage-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-BackendHealthPercentage')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Frontdoor Backend Health Percentage\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"BackendHealthPercentage\",\r\n \"metricNamespace\": \"Microsoft.Network/frontdoors\",\r\n \"metricName\": \"BackendHealthPercentage\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[if(contains(field('tags'), '_amba-BackendHealthPercentage-threshold-Override_'), field('tags._amba-BackendHealthPercentage-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", "$fxv#49": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_FD_BackendRequestLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Frontdoor Backend Request Latency Alert\",\r\n \"description\": \"Policy to audit/deploy Frontdoor Backend Request Latency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/frontdoors\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/frontdoors\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"BackendRequestLatency\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/frontdoors/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": 2\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-BackendRequestLatencyAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Frontdoor BackendRequestLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": 2,\r\n \"minFailingPeriodsToAlert\": 2\r\n },\r\n \"name\": \"ServiceApiResult\",\r\n \"metricNamespace\": \"Microsoft.Network/frontdoors\",\r\n \"metricName\": \"BackendRequestLatency\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", "$fxv#5": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_ERCIR_QosDropBitsInPerSecond_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy ExpressRoute Circuits QosDropBitsInPerSecond Alert\",\r\n \"description\": \"Policy to audit/deploy ExpressRoute Circuits QosDropBitsInPerSecond Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.3.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/expressRouteCircuits\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/expressRouteCircuits\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"QosDropBitsInPerSecond\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressRouteCircuits/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-QosDropBitsInPerSecond')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for ExpressRoute Circuit QosDropBitsInPerSecond\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"name\": \"QosDropBitsInPerSecond\",\r\n \"metricNamespace\": \"Microsoft.Network/expressRouteCircuits\",\r\n \"metricName\": \"QosDropBitsInPerSecond\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#50": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_FrontDoorCDN_OriginHealthPercentage_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy FrontDoor CDN Profile Origin Health Percentage Alert\",\n \"description\": \"Policy to audit/deploy FrontDoor Origin Health Percentage Alert\",\n \"metadata\": {\n \"version\": \"1.2.1\",\n \"Category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"90\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Cdn/profiles\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Cdn/profiles\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"OriginHealthPercentage\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Cdn/profiles/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-OriginHealthPercentage-threshold-Override_'), field('tags._amba-OriginHealthPercentage-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-OriginHealthPercentage')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for Frontdoor Origin Health Percentage\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"OriginHealthPercentage\",\n \"metricNamespace\": \"Microsoft.Cdn/profiles\",\n \"metricName\": \"OriginHealthPercentage\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-OriginHealthPercentage-threshold-Override_'), field('tags._amba-OriginHealthPercentage-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#50": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_FrontDoorCDN_OriginHealthPercentage_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy FrontDoor CDN Profile Origin Health Percentage Alert\",\r\n \"description\": \"Policy to audit/deploy FrontDoor Origin Health Percentage Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.1\",\r\n \"Category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"90\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Cdn/profiles\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Cdn/profiles\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"OriginHealthPercentage\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Cdn/profiles/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[if(contains(field('tags'), '_amba-OriginHealthPercentage-threshold-Override_'), field('tags._amba-OriginHealthPercentage-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-OriginHealthPercentage')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Frontdoor Origin Health Percentage\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"OriginHealthPercentage\",\r\n \"metricNamespace\": \"Microsoft.Cdn/profiles\",\r\n \"metricName\": \"OriginHealthPercentage\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[if(contains(field('tags'), '_amba-OriginHealthPercentage-threshold-Override_'), field('tags._amba-OriginHealthPercentage-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", "$fxv#51": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_FrontDoorCDN_OriginLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy FrontDoor CDN Profile Origin Latency Alert\",\r\n \"description\": \"Policy to audit/deploy FrontDoor CDN Profile Origin Latency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.3.0\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Cdn/profiles\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Cdn/profiles\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"OriginLatency\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Cdn/profiles/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-OriginLatencyAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Frontdoor CDN Origin Latency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"name\": \"ServiceApiResult\",\r\n \"metricNamespace\": \"Microsoft.Cdn/profiles\",\r\n \"metricName\": \"OriginLatency\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", "$fxv#52": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_FrontDoorCDN_Percentage4XX_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy FrontDoor CDN Profile Percentage4XX Alert\",\r\n \"description\": \"Policy to audit/deploy FrontDoor CDN Profile Percentage4XX Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.3.0\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Cdn/profiles\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Cdn/profiles\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"Percentage4XX\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Cdn/profiles/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-Percentage4XXAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Frontdoor CDN Origin Latency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"name\": \"ServiceApiResult\",\r\n \"metricNamespace\": \"Microsoft.Cdn/profiles\",\r\n \"metricName\": \"Percentage4XX\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", "$fxv#53": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_FrontDoorCDN_Percentage5XX_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy FrontDoor CDN Profile Percentage5XX Alert\",\r\n \"description\": \"Policy to audit/deploy FrontDoor CDN Profile Percentage5XX Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.3.0\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Cdn/profiles\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Cdn/profiles\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"Percentage5XX\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Cdn/profiles/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-Percentage5XXAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Frontdoor CDN Origin Latency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"name\": \"ServiceApiResult\",\r\n \"metricNamespace\": \"Microsoft.Cdn/profiles\",\r\n \"metricName\": \"Percentage5XX\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", @@ -185,7 +185,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Connectivity", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Network components such as Azure Firewalls, ExpressRoute, VPN, and Private DNS Zones.", "metadata": { - "version": "1.3.0", + "version": "1.4.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -5320,7 +5320,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Load Balancing", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Load Balancing Services such as Load Balancer, Application Gateway, Traffic Manager, and Azure Front Door.", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -7918,7 +7918,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Changes in Network Routing and Security", "description": "This initiative implements Azure Monitor Baseline Alerts to monitor alterations in Network Routing and Security, such as modifications to Route Tables and the removal of Network Security Groups.", "metadata": { - "version": "1.0.0", + "version": "1.1.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policyDefinitions/policies-NotificationAssets.json b/patterns/alz/policyDefinitions/policies-NotificationAssets.json index 4a4d73964..282c1a3c4 100644 --- a/patterns/alz/policyDefinitions/policies-NotificationAssets.json +++ b/patterns/alz/policyDefinitions/policies-NotificationAssets.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.29.47.4906", - "templateHash": "4449315040163899802" + "templateHash": "5625494504754486899" } }, "parameters": { @@ -125,7 +125,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts - Notification Assets", "description": "This initiative deploys Notification Assets for Azure Monitor Baseline Alerts. This includes the setup of an Alert Processing Rule and an Action Group to manage notifications and actions, along with a Notification Suppression Rule to manage alert notifications, as well as a Notification Suppression Rule to control alert notifications.", "metadata": { - "version": "1.3.0", + "version": "1.4.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policyDefinitions/policies-RecoveryServices.json b/patterns/alz/policyDefinitions/policies-RecoveryServices.json index 2d07ec201..e4876e285 100644 --- a/patterns/alz/policyDefinitions/policies-RecoveryServices.json +++ b/patterns/alz/policyDefinitions/policies-RecoveryServices.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.29.47.4906", - "templateHash": "6976424535633017796" + "templateHash": "12362857181761081736" } }, "parameters": { @@ -125,7 +125,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Recovery Services", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Recovery Services such as Azure Backup, and Azure Site Recovery.", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policyDefinitions/policies-ServiceHealth.json b/patterns/alz/policyDefinitions/policies-ServiceHealth.json index 1c8bc96b3..c76c5cd9d 100644 --- a/patterns/alz/policyDefinitions/policies-ServiceHealth.json +++ b/patterns/alz/policyDefinitions/policies-ServiceHealth.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.29.47.4906", - "templateHash": "4588768679396742130" + "templateHash": "199004107347577997" } }, "parameters": { @@ -129,7 +129,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Service Health", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Service Health Events such as Service issues, Planned maintenance, Health advisories, Security advisories, and Resource health.", "metadata": { - "version": "1.5.0", + "version": "1.6.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policyDefinitions/policies-Storage.json b/patterns/alz/policyDefinitions/policies-Storage.json index 7143072d8..ce269db88 100644 --- a/patterns/alz/policyDefinitions/policies-Storage.json +++ b/patterns/alz/policyDefinitions/policies-Storage.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.29.47.4906", - "templateHash": "2087269597795943740" + "templateHash": "97807014929754082" } }, "parameters": { @@ -125,7 +125,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Storage", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Storage Services such as Storage accounts.", "metadata": { - "version": "1.0.0", + "version": "1.1.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policyDefinitions/policies-Web.json b/patterns/alz/policyDefinitions/policies-Web.json index 0f8ea153e..087b82929 100644 --- a/patterns/alz/policyDefinitions/policies-Web.json +++ b/patterns/alz/policyDefinitions/policies-Web.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.29.47.4906", - "templateHash": "10484956955980960237" + "templateHash": "6056167114108550552" } }, "parameters": { @@ -127,7 +127,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Web", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Web Services such as App Services.", "metadata": { - "version": "1.0.0", + "version": "1.1.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policyDefinitions/policySets.json b/patterns/alz/policyDefinitions/policySets.json index 3d8f3e557..0a730fb40 100644 --- a/patterns/alz/policyDefinitions/policySets.json +++ b/patterns/alz/policyDefinitions/policySets.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.29.47.4906", - "templateHash": "810152883234755352" + "templateHash": "18127203774435763447" } }, "parameters": { @@ -5575,7 +5575,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Management", "description": "Initiative to deploy AMBA alerts relevant to the ALZ Management management group", "metadata": { - "version": "1.3.0", + "version": "1.4.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policySetDefinitions/Deploy-Connectivity-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-Connectivity-Alerts.json index d521090e6..2c5df257f 100644 --- a/patterns/alz/policySetDefinitions/Deploy-Connectivity-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-Connectivity-Alerts.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Connectivity", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Network components such as Azure Firewalls, ExpressRoute, VPN, and Private DNS Zones.", "metadata": { - "version": "1.3.0", + "version": "1.4.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policySetDefinitions/Deploy-HybridVM-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-HybridVM-Alerts.json index b8406f23b..5360d8843 100644 --- a/patterns/alz/policySetDefinitions/Deploy-HybridVM-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-HybridVM-Alerts.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Hybrid VMs", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Azure Arc-enabled Servers.", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policySetDefinitions/Deploy-Identity-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-Identity-Alerts.json index f74086708..1a66f241c 100644 --- a/patterns/alz/policySetDefinitions/Deploy-Identity-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-Identity-Alerts.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Identity", "description": "Initiative to deploy AMBA alerts relevant to the ALZ Identity management group", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policySetDefinitions/Deploy-KeyManagement-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-KeyManagement-Alerts.json index 15509b665..00577bcef 100644 --- a/patterns/alz/policySetDefinitions/Deploy-KeyManagement-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-KeyManagement-Alerts.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Key Management", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Key Management Services such as Azure Key Vault, and Managed HSM.", "metadata": { - "version": "1.0.0", + "version": "1.2.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policySetDefinitions/Deploy-LoadBalancing-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-LoadBalancing-Alerts.json index 4fac711ac..cf97f8d1e 100644 --- a/patterns/alz/policySetDefinitions/Deploy-LoadBalancing-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-LoadBalancing-Alerts.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Load Balancing", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Load Balancing Services such as Load Balancer, Application Gateway, Traffic Manager, and Azure Front Door.", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policySetDefinitions/Deploy-Management-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-Management-Alerts.json index a8953f650..bf91fe997 100644 --- a/patterns/alz/policySetDefinitions/Deploy-Management-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-Management-Alerts.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Management", "description": "Initiative to deploy AMBA alerts relevant to the ALZ Management management group", "metadata": { - "version": "1.3.0", + "version": "1.4.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policySetDefinitions/Deploy-NetworkChanges-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-NetworkChanges-Alerts.json index 5d0f842b7..872a75598 100644 --- a/patterns/alz/policySetDefinitions/Deploy-NetworkChanges-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-NetworkChanges-Alerts.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Changes in Network Routing and Security", "description": "This initiative implements Azure Monitor Baseline Alerts to monitor alterations in Network Routing and Security, such as modifications to Route Tables and the removal of Network Security Groups.", "metadata": { - "version": "1.0.0", + "version": "1.1.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policySetDefinitions/Deploy-Notification-Assets.json b/patterns/alz/policySetDefinitions/Deploy-Notification-Assets.json index f2ea921be..74fff35ea 100644 --- a/patterns/alz/policySetDefinitions/Deploy-Notification-Assets.json +++ b/patterns/alz/policySetDefinitions/Deploy-Notification-Assets.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts - Notification Assets", "description": "This initiative deploys Notification Assets for Azure Monitor Baseline Alerts. This includes the setup of an Alert Processing Rule and an Action Group to manage notifications and actions, along with a Notification Suppression Rule to manage alert notifications, as well as a Notification Suppression Rule to control alert notifications.", "metadata": { - "version": "1.3.0", + "version": "1.4.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policySetDefinitions/Deploy-RecoveryServices-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-RecoveryServices-Alerts.json index d39736a7d..38d476d2e 100644 --- a/patterns/alz/policySetDefinitions/Deploy-RecoveryServices-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-RecoveryServices-Alerts.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Recovery Services", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Recovery Services such as Azure Backup, and Azure Site Recovery.", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policySetDefinitions/Deploy-ServiceHealth-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-ServiceHealth-Alerts.json index eb75ee5b3..952ff78ed 100644 --- a/patterns/alz/policySetDefinitions/Deploy-ServiceHealth-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-ServiceHealth-Alerts.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Service Health", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Service Health Events such as Service issues, Planned maintenance, Health advisories, Security advisories, and Resource health.", "metadata": { - "version": "1.5.0", + "version": "1.6.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policySetDefinitions/Deploy-Storage-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-Storage-Alerts.json index a6c3f7e9a..7115254f0 100644 --- a/patterns/alz/policySetDefinitions/Deploy-Storage-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-Storage-Alerts.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Storage", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Storage Services such as Storage accounts.", "metadata": { - "version": "1.0.0", + "version": "1.1.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policySetDefinitions/Deploy-VM-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-VM-Alerts.json index 7b0558381..11c8715d5 100644 --- a/patterns/alz/policySetDefinitions/Deploy-VM-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-VM-Alerts.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Virtual Machines", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Azure Virtual Machines.", "metadata": { - "version": "1.0.0", + "version": "1.1.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policySetDefinitions/Deploy-Web-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-Web-Alerts.json index d821a189b..762ed8d41 100644 --- a/patterns/alz/policySetDefinitions/Deploy-Web-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-Web-Alerts.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Web", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Web Services such as App Services.", "metadata": { - "version": "1.0.0", + "version": "1.1.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/services/Compute/virtualMachines/Deploy-VM-DataDiskSpace-Alert.json b/services/Compute/virtualMachines/Deploy-VM-DataDiskSpace-Alert.json index b6a4cdd07..11ae3a03b 100644 --- a/services/Compute/virtualMachines/Deploy-VM-DataDiskSpace-Alert.json +++ b/services/Compute/virtualMachines/Deploy-VM-DataDiskSpace-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VM Data Disk Space Alert", "description": "Policy to audit/deploy VM data Disk Space Alert", "metadata": { - "version": "1.4.1", + "version": "1.2.1", "category": "Compute", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/services/HybridCompute/machines/Deploy-Hybrid-VM-DataDiskReadLatency-Alert.json b/services/HybridCompute/machines/Deploy-Hybrid-VM-DataDiskReadLatency-Alert.json index 548114a9e..800f88a9f 100644 --- a/services/HybridCompute/machines/Deploy-Hybrid-VM-DataDiskReadLatency-Alert.json +++ b/services/HybridCompute/machines/Deploy-Hybrid-VM-DataDiskReadLatency-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy Hybrid VM Data Disk Read Latency Alert", "description": "Policy to audit/deploy VM dataDiskReadLatency Alert", "metadata": { - "version": "1.2.1", + "version": "1.4.1", "category": "Hybrid Compute", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/services/HybridCompute/machines/Deploy-Hybrid-VM-OSDiskWriteLatency-Alert.json b/services/HybridCompute/machines/Deploy-Hybrid-VM-OSDiskWriteLatency-Alert.json index 04d044d1b..d39241aff 100644 --- a/services/HybridCompute/machines/Deploy-Hybrid-VM-OSDiskWriteLatency-Alert.json +++ b/services/HybridCompute/machines/Deploy-Hybrid-VM-OSDiskWriteLatency-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy Hybrid VM OS Disk Write Latency Alert", "description": "Policy to audit/deploy VM OSDiskwriteLatency Alert", "metadata": { - "version": "1.2.1", + "version": "1.8.1", "category": "Hybrid Compute", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/services/Network/applicationGateways/Deploy-AGW-ApplicationGatewayTotalTime-Alert.json b/services/Network/applicationGateways/Deploy-AGW-ApplicationGatewayTotalTime-Alert.json index fe4179fb9..9102081f5 100644 --- a/services/Network/applicationGateways/Deploy-AGW-ApplicationGatewayTotalTime-Alert.json +++ b/services/Network/applicationGateways/Deploy-AGW-ApplicationGatewayTotalTime-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy AGW ApplicationGatewayTotalTime Alert", "description": "Policy to audit/deploy Azure Application Gateway ApplicationGatewayTotalTime Alert", "metadata": { - "version": "1.4.0", + "version": "1.5.0", "Category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True" diff --git a/services/Network/applicationGateways/Deploy-AGW-BackendLastByteResponseTime-Alert.json b/services/Network/applicationGateways/Deploy-AGW-BackendLastByteResponseTime-Alert.json index c33b2760e..5b18f815c 100644 --- a/services/Network/applicationGateways/Deploy-AGW-BackendLastByteResponseTime-Alert.json +++ b/services/Network/applicationGateways/Deploy-AGW-BackendLastByteResponseTime-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy AGW BackendLastByteResponseTime Alert", "description": "Policy to audit/deploy Azure Application Gateway BackendLastByteResponseTime Alert", "metadata": { - "version": "1.4.0", + "version": "1.5.0", "Category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True" diff --git a/services/Network/applicationGateways/Deploy-AGW-CPUUtil-Alert.json b/services/Network/applicationGateways/Deploy-AGW-CPUUtil-Alert.json index ec90c50fd..1292ac5c1 100644 --- a/services/Network/applicationGateways/Deploy-AGW-CPUUtil-Alert.json +++ b/services/Network/applicationGateways/Deploy-AGW-CPUUtil-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy AGW CPU Utilization Alert", "description": "Policy to audit/deploy Azure Application Gateway CPU Utilization Alert", "metadata": { - "version": "1.2.0", + "version": "1.6.0", "Category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True" diff --git a/services/Network/applicationGateways/Deploy-AGW-CapacityUnits-Alert.json b/services/Network/applicationGateways/Deploy-AGW-CapacityUnits-Alert.json index 88be67c46..67bb62ad6 100644 --- a/services/Network/applicationGateways/Deploy-AGW-CapacityUnits-Alert.json +++ b/services/Network/applicationGateways/Deploy-AGW-CapacityUnits-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy AGW Capacity Units Alert", "description": "Policy to audit/deploy Azure Application Gateway CapacityUnits Alert", "metadata": { - "version": "1.2.0", + "version": "1.4.0", "Category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True" diff --git a/services/Network/applicationGateways/Deploy-AGW-ComputeUnits-Alert.json b/services/Network/applicationGateways/Deploy-AGW-ComputeUnits-Alert.json index a03d4fb7d..287c5c0ba 100644 --- a/services/Network/applicationGateways/Deploy-AGW-ComputeUnits-Alert.json +++ b/services/Network/applicationGateways/Deploy-AGW-ComputeUnits-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy AGW Compute Units Alert", "description": "Policy to audit/deploy Azure Application Gateway ComputeUnits Alert", "metadata": { - "version": "1.2.0", + "version": "1.4.0", "Category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True" diff --git a/services/Network/applicationGateways/Deploy-AGW-FailedRequests-Alert.json b/services/Network/applicationGateways/Deploy-AGW-FailedRequests-Alert.json index 12b7310be..42b229332 100644 --- a/services/Network/applicationGateways/Deploy-AGW-FailedRequests-Alert.json +++ b/services/Network/applicationGateways/Deploy-AGW-FailedRequests-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy AGW FailedRequests Alert", "description": "Policy to audit/deploy Azure Application Gateway FailedRequests Alert", "metadata": { - "version": "1.3.0", + "version": "1.8.0", "Category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True"