diff --git a/patterns/alz/policyDefinitions/policies-Automation.json b/patterns/alz/policyDefinitions/policies-Automation.json index c53be192b..72557a217 100644 --- a/patterns/alz/policyDefinitions/policies-Automation.json +++ b/patterns/alz/policyDefinitions/policies-Automation.json @@ -4,8 +4,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.29.47.4906", - "templateHash": "14892906486563466387" + "version": "0.30.23.60470", + "templateHash": "3920397771930135856" } }, "parameters": { @@ -115,7 +115,7 @@ "input": "[json(variables('processPolicySetDefinitionsAzureUSGovernment')[copyIndex('policySetDefinitionsAzureUSGovernment')])]" } ], - "$fxv#0": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_AA_TotalJob_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Automation Account TotalJob Alert\",\n \"description\": \"Policy to audit/deploy Automation Account TotalJob Alert\",\n \"metadata\": {\n \"version\": \"1.2.1\",\n \"category\": \"Automation\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"0\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Automation/automationAccounts\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Automation/automationAccounts\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"TotalJob\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Automation/automationAccounts/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-TotalJob-threshold-Override_'), field('tags._amba-TotalJob-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-TotalJob')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for Automation Account TotalJob Alert\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"TotalJob\",\n \"metricNamespace\": \"Microsoft.Automation/automationAccounts\",\n \"metricName\": \"TotalJob\",\n \"dimensions\": [\n {\n \"name\": \"Status\",\n \"operator\": \"Exclude\",\n \"values\": [\n \"Completed\"\n ]\n }\n ],\n \"operator\": \"GreaterThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-TotalJob-threshold-Override_'), field('tags._amba-TotalJob-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#0": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AA_TotalJob_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Automation Account TotalJob Alert\",\r\n \"description\": \"Policy to audit/deploy Automation Account TotalJob Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.1\",\r\n \"category\": \"Automation\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"0\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Automation/automationAccounts\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Automation/automationAccounts\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"TotalJob\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Automation/automationAccounts/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\r\n \"equals\": \"[[if(contains(field('tags'), '_amba-TotalJob-threshold-Override_'), field('tags._amba-TotalJob-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-TotalJob')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Automation Account TotalJob Alert\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"TotalJob\",\r\n \"metricNamespace\": \"Microsoft.Automation/automationAccounts\",\r\n \"metricName\": \"TotalJob\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Status\",\r\n \"operator\": \"Exclude\",\r\n \"values\": [\r\n \"Completed\"\r\n ]\r\n }\r\n ],\r\n \"operator\": \"GreaterThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[if(contains(field('tags'), '_amba-TotalJob-threshold-Override_'), field('tags._amba-TotalJob-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", "cloudEnv": "[environment().name]", "defaultDeploymentLocationByCloudType": { "AzureCloud": "northeurope", diff --git a/patterns/alz/policyDefinitions/policies-Compute.json b/patterns/alz/policyDefinitions/policies-Compute.json index ab9c91b69..1cfb47ffe 100644 --- a/patterns/alz/policyDefinitions/policies-Compute.json +++ b/patterns/alz/policyDefinitions/policies-Compute.json @@ -4,8 +4,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.29.47.4906", - "templateHash": "2594528588773992845" + "version": "0.30.23.60470", + "templateHash": "2633420405595385806" } }, "parameters": { @@ -115,9 +115,9 @@ "input": "[json(variables('processPolicySetDefinitionsAzureUSGovernment')[copyIndex('policySetDefinitionsAzureUSGovernment')])]" } ], - "$fxv#0": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_dataDiskReadLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM Data Disk Read Latency Alert\",\n \"description\": \"Policy to audit/deploy VM dataDiskReadLatency Alert\",\n \"metadata\": {\n \"version\": \"1.4.1\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMHighDataDiskReadLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMdataDiskReadLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMHighDataDiskReadLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighDataDiskReadLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine dataDiskReadLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#1": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_dataDiskSpace_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM Data Disk Space Alert\",\n \"description\": \"Policy to audit/deploy VM data Disk Space Alert\",\n \"metadata\": {\n \"version\": \"1.4.1\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMLowDataDiskSpaceAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMdataDiskSpaceAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMLowDataDiskSpaceAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMLowDataDiskSpaceAlert')]\",\n \"description\": \"Log Alert for Virtual Machine dataDiskSpace\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#10": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_Memory_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM Memory Alert\",\n \"description\": \"Policy to audit/deploy VM Memory Alert\",\n \"metadata\": {\n \"version\": \"1.4.1\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMLowMemoryAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\" | extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMMemoryAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMLowMemoryAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMLowMemoryAlert')]\",\n \"description\": \"Log Alert for Virtual Machine Memory\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\" | extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#0": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_dataDiskReadLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM Data Disk Read Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM dataDiskReadLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.4.1\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"30\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMHighDataDiskReadLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMdataDiskReadLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMHighDataDiskReadLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighDataDiskReadLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine dataDiskReadLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#1": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_dataDiskSpace_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM Data Disk Space Alert\",\r\n \"description\": \"Policy to audit/deploy VM data Disk Space Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.4.1\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMLowDataDiskSpaceAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMdataDiskSpaceAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMLowDataDiskSpaceAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMLowDataDiskSpaceAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine dataDiskSpace\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#10": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_Memory_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM Memory Alert\",\r\n \"description\": \"Policy to audit/deploy VM Memory Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.4.1\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMLowMemoryAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\" | extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMMemoryAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMLowMemoryAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMLowMemoryAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine Memory\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\" | extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", "$fxv#11": { "type": "Microsoft.Authorization/policySetDefinitions", "apiVersion": "2021-06-01", @@ -126,7 +126,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Virtual Machines", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Azure Virtual Machines.", "metadata": { - "version": "1.0.0", + "version": "1.1.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -2511,14 +2511,14 @@ "policyDefinitionGroups": null } }, - "$fxv#2": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_dataDiskWriteLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM Data Disk Write Latency Alert\",\n \"description\": \"Policy to audit/deploy VM dataDiskWriteLatency Alert\",\n \"metadata\": {\n \"version\": \"1.4.1\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMHighDataDiskWriteLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMdataDiskWriteLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMHighDataDiskWriteLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighDataDiskWriteLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine dataDiskWriteLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#3": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_HeartBeat_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM HeartBeat Alert\",\n \"description\": \"Policy to audit/deploy VM HeartBeat Alert for all VMs in the subscription\",\n \"metadata\": {\n \"version\": \"1.4.1\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"1\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT6H\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMHeartBeatAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-Heartbeat-threshold-Override_\\\"); Heartbeat | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\\\"minute\\\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-Heartbeat-threshold-Override_\\\", tostring(tags.[\\\"_amba-Heartbeat-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HeartBeatAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMHeartBeatAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMHeartBeatAlert')]\",\n \"description\": \"Log Alert for Virtual Machine Heartbeat\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-Heartbeat-threshold-Override_\\\"); Heartbeat | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\\\"minute\\\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-Heartbeat-threshold-Override_\\\", tostring(tags.[\\\"_amba-Heartbeat-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#4": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_NetworkIn_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM Network Read Alert\",\n \"description\": \"Policy to audit/deploy VM Network Read Alert\",\n \"metadata\": {\n \"version\": \"1.4.1\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10000000\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMHighNetworkInAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMNetworkInAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMHighNetworkInAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighNetworkInAlert')]\",\n \"description\": \"Log Alert for Virtual Machine NetworkIn\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"NetworkInterface\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#5": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_NetworkOut_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM Network Write Alert\",\n \"description\": \"Policy to audit/deploy VM Network Out Alert\",\n \"metadata\": {\n \"version\": \"1.4.1\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10000000\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMHighNetworkOutAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMNetworkOutAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMHighNetworkOutAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighNetworkOutAlert')]\",\n \"description\": \"Log Alert for Virtual Machine NetworkOut\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"NetworkInterface\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#6": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_OSDiskreadLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM OS Disk Read Latency Alert\",\n \"description\": \"Policy to audit/deploy VM OSDiskreadLatency Alert\",\n \"metadata\": {\n \"version\": \"1.4.1\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMHighOSDiskReadLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMOSDiskreadLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMHighOSDiskReadLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighOSDiskReadLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine OSDiskreadLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#7": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_OSDiskSpace_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM OS Disk Space Alert\",\n \"description\": \"Policy to audit/deploy VM OSDiskSpace Alert\",\n \"metadata\": {\n \"version\": \"1.4.1\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMLowOSDiskSpaceAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMOSDiskSpaceAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMLowOSDiskSpaceAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMLowOSDiskSpaceAlert')]\",\n \"description\": \"Log Alert for Virtual Machine OSDiskSpace\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#8": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_OSDiskwriteLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM OS Disk Write Latency Alert\",\n \"description\": \"Policy to audit/deploy VM OSDiskwriteLatency Alert\",\n \"metadata\": {\n \"version\": \"1.4.1\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMHighOSDiskWriteLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMOSDiskwriteLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMHighOSDiskWriteLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighOSDiskWriteLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine OSDiskwriteLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#9": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_CPU_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM CPU Alert\",\n \"description\": \"Policy to audit/deploy VM CPU Alert\",\n \"metadata\": {\n \"version\": \"1.4.1\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"85\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMHighCPUAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-UtilizationPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMCPUAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMHighCPUAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighCPUAlert')]\",\n \"description\": \"Log Alert for Virtual Machine CPU\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-UtilizationPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#2": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_dataDiskWriteLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM Data Disk Write Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM dataDiskWriteLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.4.1\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"30\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMHighDataDiskWriteLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMdataDiskWriteLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMHighDataDiskWriteLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighDataDiskWriteLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine dataDiskWriteLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#3": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_HeartBeat_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM HeartBeat Alert\",\r\n \"description\": \"Policy to audit/deploy VM HeartBeat Alert for all VMs in the subscription\",\r\n \"metadata\": {\r\n \"version\": \"1.4.1\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"1\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT6H\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMHeartBeatAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-Heartbeat-threshold-Override_\\\"); Heartbeat | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\\\"minute\\\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-Heartbeat-threshold-Override_\\\", tostring(tags.[\\\"_amba-Heartbeat-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HeartBeatAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMHeartBeatAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMHeartBeatAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine Heartbeat\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-Heartbeat-threshold-Override_\\\"); Heartbeat | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\\\"minute\\\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-Heartbeat-threshold-Override_\\\", tostring(tags.[\\\"_amba-Heartbeat-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#4": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_NetworkIn_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM Network Read Alert\",\r\n \"description\": \"Policy to audit/deploy VM Network Read Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.4.1\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10000000\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMHighNetworkInAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMNetworkInAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMHighNetworkInAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighNetworkInAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine NetworkIn\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"NetworkInterface\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#5": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_NetworkOut_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM Network Write Alert\",\r\n \"description\": \"Policy to audit/deploy VM Network Out Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.4.1\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10000000\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMHighNetworkOutAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMNetworkOutAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMHighNetworkOutAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighNetworkOutAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine NetworkOut\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"NetworkInterface\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#6": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_OSDiskreadLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM OS Disk Read Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM OSDiskreadLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.4.1\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"30\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMHighOSDiskReadLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMOSDiskreadLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMHighOSDiskReadLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighOSDiskReadLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine OSDiskreadLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#7": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_OSDiskSpace_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM OS Disk Space Alert\",\r\n \"description\": \"Policy to audit/deploy VM OSDiskSpace Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.4.1\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMLowOSDiskSpaceAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMOSDiskSpaceAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMLowOSDiskSpaceAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMLowOSDiskSpaceAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine OSDiskSpace\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#8": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_OSDiskwriteLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM OS Disk Write Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM OSDiskwriteLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.4.1\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"30\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMHighOSDiskWriteLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMOSDiskwriteLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMHighOSDiskWriteLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighOSDiskWriteLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine OSDiskwriteLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#9": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_CPU_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM CPU Alert\",\r\n \"description\": \"Policy to audit/deploy VM CPU Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.4.1\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"85\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMHighCPUAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-UtilizationPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMCPUAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMHighCPUAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighCPUAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine CPU\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-UtilizationPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", "cloudEnv": "[environment().name]", "defaultDeploymentLocationByCloudType": { "AzureCloud": "northeurope", diff --git a/patterns/alz/policyDefinitions/policies-Hybrid.json b/patterns/alz/policyDefinitions/policies-Hybrid.json index e0e479557..c338d4108 100644 --- a/patterns/alz/policyDefinitions/policies-Hybrid.json +++ b/patterns/alz/policyDefinitions/policies-Hybrid.json @@ -4,8 +4,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.29.47.4906", - "templateHash": "7697697196028043788" + "version": "0.30.23.60470", + "templateHash": "13450834450127681962" } }, "parameters": { @@ -115,10 +115,10 @@ "input": "[json(variables('processPolicySetDefinitionsAzureUSGovernment')[copyIndex('policySetDefinitionsAzureUSGovernment')])]" } ], - "$fxv#0": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_dataDiskReadLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Data Disk Read Latency Alert\",\n \"description\": \"Policy to audit/deploy VM dataDiskReadLatency Alert\",\n \"metadata\": {\n \"version\": \"1.2.1\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskReadLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMdataDiskReadLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskReadLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskReadLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine dataDiskReadLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#1": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_dataDiskSpace_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Data Disk Space Alert\",\n \"description\": \"Policy to audit/deploy VM data Disk Space Alert\",\n \"metadata\": {\n \"version\": \"1.2.1\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMLowDataDiskSpaceAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMdataDiskSpaceAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMLowDataDiskSpaceAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMLowDataDiskSpaceAlert')]\",\n \"description\": \"Log Alert for Virtual Machine dataDiskSpace\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#10": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_Memory_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Memory Alert\",\n \"description\": \"Policy to audit/deploy VM Memory Alert\",\n \"metadata\": {\n \"version\": \"1.2.1\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMLowMemoryAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\" | extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMMemoryAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMLowMemoryAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMLowMemoryAlert')]\",\n \"description\": \"Log Alert for Virtual Machine Memory\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\" | extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#11": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_Disconnected_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Disconnected Alert\",\n \"description\": \"Policy to Deploy Hybrid VM Disconnected Alert\",\n \"metadata\": {\n \"version\": \"1.4.0\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"1\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"P1D\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT10M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT2H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT10M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"defaultValue\": \"10m\",\n \"allowedValues\": [\n \"5m\",\n \"10m\",\n \"15m\",\n \"30m\",\n \"1h\",\n \"2h\",\n \"3h\",\n \"6h\",\n \"12h\",\n \"1d\",\n \"2d\",\n \"3d\",\n \"7d\"\n ],\n \"metadata\": {\n \"displayName\": \"Hybrid VM Disconnected Threshold (expressed in timespan)\",\n \"description\": \"Threshold in timespan value for the Hybrid VM Disconnected alert\"\n }\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMDisconnectedAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | where parse_json(tostring(tags.{0})) !in~ (\\\"{1}\\\") | where tostring(properties.status) == \\\"Disconnected\\\" | extend lastContactedDate = todatetime(properties.lastStatusChange) | where lastContactedDate <= ago(totimespan(policyThresholdString)) | extend status = tostring(properties.status) | project id, Computer=name, status, lastContactedDate', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMDisconnectedAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMDisconnectedAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMDisconnectedAlert')]\",\n \"description\": \"Hybrid VM in disconnected state. Not being connected, prevents extensions to be correctly managed from the portal and Azure policies to be correctly applied. Ensure that both server the specific service (Azure Hybrid Instance Metadata Service on Windows or azcmagent on Linux) are running.\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | where parse_json(tostring(tags.{0})) !in~ (\\\"{1}\\\") | where tostring(properties.status) == \\\"Disconnected\\\" | extend lastContactedDate = todatetime(properties.lastStatusChange) | where lastContactedDate <= ago(totimespan(policyThresholdString)) | extend status = tostring(properties.status) | project id, Computer=name, status, lastContactedDate', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"resourceIdColumn\": \"id\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#0": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_dataDiskReadLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Data Disk Read Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM dataDiskReadLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"30\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskReadLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMdataDiskReadLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskReadLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskReadLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine dataDiskReadLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#1": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_dataDiskSpace_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Data Disk Space Alert\",\r\n \"description\": \"Policy to audit/deploy VM data Disk Space Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMLowDataDiskSpaceAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMdataDiskSpaceAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMLowDataDiskSpaceAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMLowDataDiskSpaceAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine dataDiskSpace\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#10": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_Memory_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Memory Alert\",\r\n \"description\": \"Policy to audit/deploy VM Memory Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMLowMemoryAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\" | extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMMemoryAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMLowMemoryAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMLowMemoryAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine Memory\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\" | extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-AvailableMemoryPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#11": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_Disconnected_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Disconnected Alert\",\r\n \"description\": \"Policy to Deploy Hybrid VM Disconnected Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.4.0\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"1\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"P1D\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT10M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT2H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT10M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"defaultValue\": \"10m\",\r\n \"allowedValues\": [\r\n \"5m\",\r\n \"10m\",\r\n \"15m\",\r\n \"30m\",\r\n \"1h\",\r\n \"2h\",\r\n \"3h\",\r\n \"6h\",\r\n \"12h\",\r\n \"1d\",\r\n \"2d\",\r\n \"3d\",\r\n \"7d\"\r\n ],\r\n \"metadata\": {\r\n \"displayName\": \"Hybrid VM Disconnected Threshold (expressed in timespan)\",\r\n \"description\": \"Threshold in timespan value for the Hybrid VM Disconnected alert\"\r\n }\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMDisconnectedAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | where parse_json(tostring(tags.{0})) !in~ (\\\"{1}\\\") | where tostring(properties.status) == \\\"Disconnected\\\" | extend lastContactedDate = todatetime(properties.lastStatusChange) | where lastContactedDate <= ago(totimespan(policyThresholdString)) | extend status = tostring(properties.status) | project id, Computer=name, status, lastContactedDate', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMDisconnectedAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMDisconnectedAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMDisconnectedAlert')]\",\r\n \"description\": \"Hybrid VM in disconnected state. Not being connected, prevents extensions to be correctly managed from the portal and Azure policies to be correctly applied. Ensure that both server the specific service (Azure Hybrid Instance Metadata Service on Windows or azcmagent on Linux) are running.\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | where parse_json(tostring(tags.{0})) !in~ (\\\"{1}\\\") | where tostring(properties.status) == \\\"Disconnected\\\" | extend lastContactedDate = todatetime(properties.lastStatusChange) | where lastContactedDate <= ago(totimespan(policyThresholdString)) | extend status = tostring(properties.status) | project id, Computer=name, status, lastContactedDate', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"resourceIdColumn\": \"id\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", "$fxv#12": { "type": "Microsoft.Authorization/policySetDefinitions", "apiVersion": "2021-06-01", @@ -127,7 +127,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Hybrid VMs", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Azure Arc-enabled Servers.", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -2700,14 +2700,14 @@ "policyDefinitionGroups": null } }, - "$fxv#2": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_dataDiskWriteLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Data Disk Write Latency Alert\",\n \"description\": \"Policy to audit/deploy VM dataDiskWriteLatency Alert\",\n \"metadata\": {\n \"version\": \"1.2.1\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskWriteLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMdataDiskWriteLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskWriteLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskWriteLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine dataDiskWriteLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#3": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_HeartBeat_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM HeartBeat Alert\",\n \"description\": \"Policy to audit/deploy VM HeartBeat Alert for all VMs in the subscription\",\n \"metadata\": {\n \"version\": \"1.2.1\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"1\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT6H\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHeartBeatAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-Heartbeat-threshold-Override_\\\"); Heartbeat | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\\\"minute\\\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-Heartbeat-threshold-Override_\\\", tostring(tags.[\\\"_amba-Heartbeat-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMHeartBeatAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHeartBeatAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHeartBeatAlert')]\",\n \"description\": \"Log Alert for Virtual Machine Heartbeat\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-Heartbeat-threshold-Override_\\\"); Heartbeat | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\\\"minute\\\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-Heartbeat-threshold-Override_\\\", tostring(tags.[\\\"_amba-Heartbeat-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#4": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_NetworkIn_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Network Read Alert\",\n \"description\": \"Policy to audit/deploy VM Nework Read Alert\",\n \"metadata\": {\n \"version\": \"1.2.1\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10000000\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkInAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMVMNetworkInAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkInAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkInAlert')]\",\n \"description\": \"Log Alert for Virtual Machine NetworkIn\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"NetworkInterface\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#5": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_NetworkOut_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Network Write Alert\",\n \"description\": \"Policy to audit/deploy VM Network Out Alert\",\n \"metadata\": {\n \"version\": \"1.2.1\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10000000\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkOutAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMVMNetworkOutAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkOutAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkOutAlert')]\",\n \"description\": \"Log Alert for Virtual Machine NetworkOut\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"NetworkInterface\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#6": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_OSDiskreadLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM OS Disk Read Latency Alert\",\n \"description\": \"Policy to audit/deploy VM OSDiskreadLatency Alert\",\n \"metadata\": {\n \"version\": \"1.2.1\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskReadLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMOSDiskreadLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskReadLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskReadLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine OSDiskreadLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#7": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_OSDiskSpace_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM OS Disk Space Alert\",\n \"description\": \"Policy to audit/deploy VM OSDiskSpace Alert\",\n \"metadata\": {\n \"version\": \"1.2.1\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskSpaceAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMOSDiskSpaceAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskSpaceAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskSpaceAlert')]\",\n \"description\": \"Log Alert for Virtual Machine OSDiskSpace\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#8": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_OSDiskwriteLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM OS Disk Write Latency Alert\",\n \"description\": \"Policy to audit/deploy VM OSDiskwriteLatency Alert\",\n \"metadata\": {\n \"version\": \"1.2.1\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskWriteLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMOSDiskwriteLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskWriteLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskWriteLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine OSDiskwriteLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", - "$fxv#9": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_CPU_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM CPU Alert\",\n \"description\": \"Policy to audit/deploy VM CPU Alert\",\n \"metadata\": {\n \"version\": \"1.2.1\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"85\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighCPUAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-UtilizationPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMCPUAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighCPUAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighCPUAlert')]\",\n \"description\": \"Log Alert for Virtual Machine CPU\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-UtilizationPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#2": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_dataDiskWriteLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Data Disk Write Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM dataDiskWriteLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"30\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskWriteLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMdataDiskWriteLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskWriteLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskWriteLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine dataDiskWriteLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#3": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_HeartBeat_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM HeartBeat Alert\",\r\n \"description\": \"Policy to audit/deploy VM HeartBeat Alert for all VMs in the subscription\",\r\n \"metadata\": {\r\n \"version\": \"1.2.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"1\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT6H\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHeartBeatAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-Heartbeat-threshold-Override_\\\"); Heartbeat | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\\\"minute\\\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-Heartbeat-threshold-Override_\\\", tostring(tags.[\\\"_amba-Heartbeat-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMHeartBeatAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHeartBeatAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHeartBeatAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine Heartbeat\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-Heartbeat-threshold-Override_\\\"); Heartbeat | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\\\"minute\\\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-Heartbeat-threshold-Override_\\\", tostring(tags.[\\\"_amba-Heartbeat-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#4": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_NetworkIn_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Network Read Alert\",\r\n \"description\": \"Policy to audit/deploy VM Nework Read Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10000000\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkInAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMVMNetworkInAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkInAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkInAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine NetworkIn\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"NetworkInterface\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#5": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_NetworkOut_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Network Write Alert\",\r\n \"description\": \"Policy to audit/deploy VM Network Out Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10000000\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkOutAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMVMNetworkOutAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkOutAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkOutAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine NetworkOut\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteBytesPerSecond-Data-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"NetworkInterface\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#6": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_OSDiskreadLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM OS Disk Read Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM OSDiskreadLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"30\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskReadLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMOSDiskreadLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskReadLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskReadLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine OSDiskreadLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#7": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_OSDiskSpace_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM OS Disk Space Alert\",\r\n \"description\": \"Policy to audit/deploy VM OSDiskSpace Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskSpaceAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMOSDiskSpaceAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskSpaceAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskSpaceAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine OSDiskSpace\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#8": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_OSDiskwriteLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM OS Disk Write Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM OSDiskwriteLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"30\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskWriteLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMOSDiskwriteLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskWriteLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskWriteLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine OSDiskwriteLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-OS-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#9": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_CPU_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM CPU Alert\",\r\n \"description\": \"Policy to audit/deploy VM CPU Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"85\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighCPUAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-UtilizationPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMCPUAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighCPUAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighCPUAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine CPU\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-UtilizationPercentage-threshold-Override_\\\", tostring(tags.[\\\"_amba-UtilizationPercentage-threshold-Override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", "cloudEnv": "[environment().name]", "defaultDeploymentLocationByCloudType": { "AzureCloud": "northeurope", diff --git a/patterns/alz/policyDefinitions/policies-KeyManagement.json b/patterns/alz/policyDefinitions/policies-KeyManagement.json index f00db9384..595bbbfca 100644 --- a/patterns/alz/policyDefinitions/policies-KeyManagement.json +++ b/patterns/alz/policyDefinitions/policies-KeyManagement.json @@ -4,8 +4,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.29.47.4906", - "templateHash": "10499038651207382897" + "version": "0.30.23.60470", + "templateHash": "10835276681278327642" } }, "parameters": { @@ -131,7 +131,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Key Management", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Key Management Services such as Azure Key Vault, and Managed HSM.", "metadata": { - "version": "1.0.0", + "version": "1.1.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -921,7 +921,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Identity", "description": "Initiative to deploy AMBA alerts relevant to the ALZ Identity management group", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policyDefinitions/policies-Monitoring.json b/patterns/alz/policyDefinitions/policies-Monitoring.json index bde9a7730..c41d52dce 100644 --- a/patterns/alz/policyDefinitions/policies-Monitoring.json +++ b/patterns/alz/policyDefinitions/policies-Monitoring.json @@ -4,8 +4,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.29.47.4906", - "templateHash": "11296315682034990206" + "version": "0.30.23.60470", + "templateHash": "4095482272665592408" } }, "parameters": { diff --git a/patterns/alz/policyDefinitions/policies-Network.json b/patterns/alz/policyDefinitions/policies-Network.json index 34a0dca5e..8bf99a4f1 100644 --- a/patterns/alz/policyDefinitions/policies-Network.json +++ b/patterns/alz/policyDefinitions/policies-Network.json @@ -4,8 +4,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.29.47.4906", - "templateHash": "7806782844238847877" + "version": "0.30.23.60470", + "templateHash": "3030255228421662663" } }, "parameters": { @@ -161,7 +161,7 @@ "$fxv#48": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_FD_BackendHealth_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Frontdoor Backend Health Percentage Alert\",\r\n \"description\": \"Policy to audit/deploy FrontDoor Backend Health Percentage Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.1\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"90\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/frontdoors\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/frontdoors\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"BackendHealthPercentage\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/frontdoors/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[if(contains(field('tags'), '_amba-BackendHealthPercentage-threshold-Override_'), field('tags._amba-BackendHealthPercentage-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-BackendHealthPercentage')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Frontdoor Backend Health Percentage\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"BackendHealthPercentage\",\r\n \"metricNamespace\": \"Microsoft.Network/frontdoors\",\r\n \"metricName\": \"BackendHealthPercentage\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[if(contains(field('tags'), '_amba-BackendHealthPercentage-threshold-Override_'), field('tags._amba-BackendHealthPercentage-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", "$fxv#49": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_FD_BackendRequestLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Frontdoor Backend Request Latency Alert\",\r\n \"description\": \"Policy to audit/deploy Frontdoor Backend Request Latency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/frontdoors\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/frontdoors\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"BackendRequestLatency\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/frontdoors/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": 2\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-BackendRequestLatencyAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Frontdoor BackendRequestLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": 2,\r\n \"minFailingPeriodsToAlert\": 2\r\n },\r\n \"name\": \"ServiceApiResult\",\r\n \"metricNamespace\": \"Microsoft.Network/frontdoors\",\r\n \"metricName\": \"BackendRequestLatency\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", "$fxv#5": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_ERCIR_QosDropBitsInPerSecond_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy ExpressRoute Circuits QosDropBitsInPerSecond Alert\",\r\n \"description\": \"Policy to audit/deploy ExpressRoute Circuits QosDropBitsInPerSecond Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.3.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/expressRouteCircuits\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/expressRouteCircuits\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"QosDropBitsInPerSecond\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressRouteCircuits/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-QosDropBitsInPerSecond')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for ExpressRoute Circuit QosDropBitsInPerSecond\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"name\": \"QosDropBitsInPerSecond\",\r\n \"metricNamespace\": \"Microsoft.Network/expressRouteCircuits\",\r\n \"metricName\": \"QosDropBitsInPerSecond\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#50": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_FrontDoorCDN_OriginHealthPercentage_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy FrontDoor CDN Profile Origin Health Percentage Alert\",\n \"description\": \"Policy to audit/deploy FrontDoor Origin Health Percentage Alert\",\n \"metadata\": {\n \"version\": \"1.2.1\",\n \"Category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"90\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Cdn/profiles\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Cdn/profiles\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"OriginHealthPercentage\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Cdn/profiles/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-OriginHealthPercentage-threshold-Override_'), field('tags._amba-OriginHealthPercentage-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-OriginHealthPercentage')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for Frontdoor Origin Health Percentage\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"OriginHealthPercentage\",\n \"metricNamespace\": \"Microsoft.Cdn/profiles\",\n \"metricName\": \"OriginHealthPercentage\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-OriginHealthPercentage-threshold-Override_'), field('tags._amba-OriginHealthPercentage-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#50": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_FrontDoorCDN_OriginHealthPercentage_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy FrontDoor CDN Profile Origin Health Percentage Alert\",\r\n \"description\": \"Policy to audit/deploy FrontDoor Origin Health Percentage Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.1\",\r\n \"Category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"90\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Cdn/profiles\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Cdn/profiles\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"OriginHealthPercentage\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Cdn/profiles/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[if(contains(field('tags'), '_amba-OriginHealthPercentage-threshold-Override_'), field('tags._amba-OriginHealthPercentage-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-OriginHealthPercentage')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Frontdoor Origin Health Percentage\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"OriginHealthPercentage\",\r\n \"metricNamespace\": \"Microsoft.Cdn/profiles\",\r\n \"metricName\": \"OriginHealthPercentage\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[if(contains(field('tags'), '_amba-OriginHealthPercentage-threshold-Override_'), field('tags._amba-OriginHealthPercentage-threshold-Override_'), parameters('threshold'))]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", "$fxv#51": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_FrontDoorCDN_OriginLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy FrontDoor CDN Profile Origin Latency Alert\",\r\n \"description\": \"Policy to audit/deploy FrontDoor CDN Profile Origin Latency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.3.0\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Cdn/profiles\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Cdn/profiles\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"OriginLatency\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Cdn/profiles/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-OriginLatencyAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Frontdoor CDN Origin Latency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"name\": \"ServiceApiResult\",\r\n \"metricNamespace\": \"Microsoft.Cdn/profiles\",\r\n \"metricName\": \"OriginLatency\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", "$fxv#52": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_FrontDoorCDN_Percentage4XX_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy FrontDoor CDN Profile Percentage4XX Alert\",\r\n \"description\": \"Policy to audit/deploy FrontDoor CDN Profile Percentage4XX Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.3.0\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Cdn/profiles\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Cdn/profiles\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"Percentage4XX\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Cdn/profiles/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-Percentage4XXAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Frontdoor CDN Origin Latency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"name\": \"ServiceApiResult\",\r\n \"metricNamespace\": \"Microsoft.Cdn/profiles\",\r\n \"metricName\": \"Percentage4XX\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", "$fxv#53": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_FrontDoorCDN_Percentage5XX_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy FrontDoor CDN Profile Percentage5XX Alert\",\r\n \"description\": \"Policy to audit/deploy FrontDoor CDN Profile Percentage5XX Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.3.0\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"2\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Cdn/profiles\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Cdn/profiles\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"Percentage5XX\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Cdn/profiles/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-Percentage5XXAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Frontdoor CDN Origin Latency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"name\": \"ServiceApiResult\",\r\n \"metricNamespace\": \"Microsoft.Cdn/profiles\",\r\n \"metricName\": \"Percentage5XX\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", @@ -185,7 +185,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Connectivity", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Network components such as Azure Firewalls, ExpressRoute, VPN, and Private DNS Zones.", "metadata": { - "version": "1.3.0", + "version": "1.4.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -5320,7 +5320,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Load Balancing", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Load Balancing Services such as Load Balancer, Application Gateway, Traffic Manager, and Azure Front Door.", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -7918,7 +7918,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Changes in Network Routing and Security", "description": "This initiative implements Azure Monitor Baseline Alerts to monitor alterations in Network Routing and Security, such as modifications to Route Tables and the removal of Network Security Groups.", "metadata": { - "version": "1.0.0", + "version": "1.1.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policyDefinitions/policies-NotificationAssets.json b/patterns/alz/policyDefinitions/policies-NotificationAssets.json index 4a4d73964..d169bbf2e 100644 --- a/patterns/alz/policyDefinitions/policies-NotificationAssets.json +++ b/patterns/alz/policyDefinitions/policies-NotificationAssets.json @@ -4,8 +4,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.29.47.4906", - "templateHash": "4449315040163899802" + "version": "0.30.23.60470", + "templateHash": "18144807407443132494" } }, "parameters": { @@ -125,7 +125,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts - Notification Assets", "description": "This initiative deploys Notification Assets for Azure Monitor Baseline Alerts. This includes the setup of an Alert Processing Rule and an Action Group to manage notifications and actions, along with a Notification Suppression Rule to manage alert notifications, as well as a Notification Suppression Rule to control alert notifications.", "metadata": { - "version": "1.3.0", + "version": "1.4.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policyDefinitions/policies-RecoveryServices.json b/patterns/alz/policyDefinitions/policies-RecoveryServices.json index 2d07ec201..d67cb1a64 100644 --- a/patterns/alz/policyDefinitions/policies-RecoveryServices.json +++ b/patterns/alz/policyDefinitions/policies-RecoveryServices.json @@ -4,8 +4,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.29.47.4906", - "templateHash": "6976424535633017796" + "version": "0.30.23.60470", + "templateHash": "8493107720929555144" } }, "parameters": { @@ -125,7 +125,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Recovery Services", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Recovery Services such as Azure Backup, and Azure Site Recovery.", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policyDefinitions/policies-ServiceHealth.json b/patterns/alz/policyDefinitions/policies-ServiceHealth.json index 1c8bc96b3..dd87c7b11 100644 --- a/patterns/alz/policyDefinitions/policies-ServiceHealth.json +++ b/patterns/alz/policyDefinitions/policies-ServiceHealth.json @@ -4,8 +4,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.29.47.4906", - "templateHash": "4588768679396742130" + "version": "0.30.23.60470", + "templateHash": "15830516696506833566" } }, "parameters": { @@ -129,7 +129,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Service Health", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Service Health Events such as Service issues, Planned maintenance, Health advisories, Security advisories, and Resource health.", "metadata": { - "version": "1.5.0", + "version": "1.6.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policyDefinitions/policies-Storage.json b/patterns/alz/policyDefinitions/policies-Storage.json index 7143072d8..8f6f884b6 100644 --- a/patterns/alz/policyDefinitions/policies-Storage.json +++ b/patterns/alz/policyDefinitions/policies-Storage.json @@ -4,8 +4,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.29.47.4906", - "templateHash": "2087269597795943740" + "version": "0.30.23.60470", + "templateHash": "11303601411165319510" } }, "parameters": { @@ -125,7 +125,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Storage", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Storage Services such as Storage accounts.", "metadata": { - "version": "1.0.0", + "version": "1.1.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policyDefinitions/policies-Web.json b/patterns/alz/policyDefinitions/policies-Web.json index 0f8ea153e..268872061 100644 --- a/patterns/alz/policyDefinitions/policies-Web.json +++ b/patterns/alz/policyDefinitions/policies-Web.json @@ -4,8 +4,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.29.47.4906", - "templateHash": "10484956955980960237" + "version": "0.30.23.60470", + "templateHash": "6009367551068036179" } }, "parameters": { @@ -127,7 +127,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Web", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Web Services such as App Services.", "metadata": { - "version": "1.0.0", + "version": "1.1.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policyDefinitions/policySets.json b/patterns/alz/policyDefinitions/policySets.json index 3d8f3e557..d618d7732 100644 --- a/patterns/alz/policyDefinitions/policySets.json +++ b/patterns/alz/policyDefinitions/policySets.json @@ -4,8 +4,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.29.47.4906", - "templateHash": "810152883234755352" + "version": "0.30.23.60470", + "templateHash": "996929183101830606" } }, "parameters": { @@ -5575,7 +5575,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Management", "description": "Initiative to deploy AMBA alerts relevant to the ALZ Management management group", "metadata": { - "version": "1.3.0", + "version": "1.4.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policySetDefinitions/Deploy-Connectivity-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-Connectivity-Alerts.json index d521090e6..334f01cf6 100644 --- a/patterns/alz/policySetDefinitions/Deploy-Connectivity-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-Connectivity-Alerts.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Connectivity", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Network components such as Azure Firewalls, ExpressRoute, VPN, and Private DNS Zones.", "metadata": { - "version": "1.3.0", + "version": "1.5.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policySetDefinitions/Deploy-HybridVM-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-HybridVM-Alerts.json index b8406f23b..5360d8843 100644 --- a/patterns/alz/policySetDefinitions/Deploy-HybridVM-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-HybridVM-Alerts.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Hybrid VMs", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Azure Arc-enabled Servers.", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policySetDefinitions/Deploy-Identity-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-Identity-Alerts.json index f74086708..1a66f241c 100644 --- a/patterns/alz/policySetDefinitions/Deploy-Identity-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-Identity-Alerts.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Identity", "description": "Initiative to deploy AMBA alerts relevant to the ALZ Identity management group", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policySetDefinitions/Deploy-KeyManagement-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-KeyManagement-Alerts.json index 15509b665..e02f05331 100644 --- a/patterns/alz/policySetDefinitions/Deploy-KeyManagement-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-KeyManagement-Alerts.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Key Management", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Key Management Services such as Azure Key Vault, and Managed HSM.", "metadata": { - "version": "1.0.0", + "version": "1.1.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policySetDefinitions/Deploy-LoadBalancing-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-LoadBalancing-Alerts.json index 4fac711ac..cf97f8d1e 100644 --- a/patterns/alz/policySetDefinitions/Deploy-LoadBalancing-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-LoadBalancing-Alerts.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Load Balancing", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Load Balancing Services such as Load Balancer, Application Gateway, Traffic Manager, and Azure Front Door.", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policySetDefinitions/Deploy-Management-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-Management-Alerts.json index a8953f650..bf91fe997 100644 --- a/patterns/alz/policySetDefinitions/Deploy-Management-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-Management-Alerts.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Management", "description": "Initiative to deploy AMBA alerts relevant to the ALZ Management management group", "metadata": { - "version": "1.3.0", + "version": "1.4.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policySetDefinitions/Deploy-NetworkChanges-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-NetworkChanges-Alerts.json index 5d0f842b7..872a75598 100644 --- a/patterns/alz/policySetDefinitions/Deploy-NetworkChanges-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-NetworkChanges-Alerts.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Changes in Network Routing and Security", "description": "This initiative implements Azure Monitor Baseline Alerts to monitor alterations in Network Routing and Security, such as modifications to Route Tables and the removal of Network Security Groups.", "metadata": { - "version": "1.0.0", + "version": "1.1.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policySetDefinitions/Deploy-Notification-Assets.json b/patterns/alz/policySetDefinitions/Deploy-Notification-Assets.json index f2ea921be..74fff35ea 100644 --- a/patterns/alz/policySetDefinitions/Deploy-Notification-Assets.json +++ b/patterns/alz/policySetDefinitions/Deploy-Notification-Assets.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts - Notification Assets", "description": "This initiative deploys Notification Assets for Azure Monitor Baseline Alerts. This includes the setup of an Alert Processing Rule and an Action Group to manage notifications and actions, along with a Notification Suppression Rule to manage alert notifications, as well as a Notification Suppression Rule to control alert notifications.", "metadata": { - "version": "1.3.0", + "version": "1.4.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policySetDefinitions/Deploy-RecoveryServices-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-RecoveryServices-Alerts.json index d39736a7d..38d476d2e 100644 --- a/patterns/alz/policySetDefinitions/Deploy-RecoveryServices-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-RecoveryServices-Alerts.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Recovery Services", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Recovery Services such as Azure Backup, and Azure Site Recovery.", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policySetDefinitions/Deploy-ServiceHealth-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-ServiceHealth-Alerts.json index eb75ee5b3..952ff78ed 100644 --- a/patterns/alz/policySetDefinitions/Deploy-ServiceHealth-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-ServiceHealth-Alerts.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Service Health", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Service Health Events such as Service issues, Planned maintenance, Health advisories, Security advisories, and Resource health.", "metadata": { - "version": "1.5.0", + "version": "1.6.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policySetDefinitions/Deploy-Storage-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-Storage-Alerts.json index a6c3f7e9a..7115254f0 100644 --- a/patterns/alz/policySetDefinitions/Deploy-Storage-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-Storage-Alerts.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Storage", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Storage Services such as Storage accounts.", "metadata": { - "version": "1.0.0", + "version": "1.1.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policySetDefinitions/Deploy-VM-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-VM-Alerts.json index 7b0558381..11c8715d5 100644 --- a/patterns/alz/policySetDefinitions/Deploy-VM-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-VM-Alerts.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Virtual Machines", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Azure Virtual Machines.", "metadata": { - "version": "1.0.0", + "version": "1.1.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ diff --git a/patterns/alz/policySetDefinitions/Deploy-Web-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-Web-Alerts.json index d821a189b..762ed8d41 100644 --- a/patterns/alz/policySetDefinitions/Deploy-Web-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-Web-Alerts.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Web", "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Web Services such as App Services.", "metadata": { - "version": "1.0.0", + "version": "1.1.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [