Skip to content

Commit a05034b

Browse files
AbbyMSFTAbbyMSFT
committed
Common schema
1 parent 3c2ede9 commit a05034b

File tree

1 file changed

+7
-171
lines changed

1 file changed

+7
-171
lines changed

‎articles/azure-monitor/alerts/alerts-common-schema.md

Lines changed: 7 additions & 171 deletions
Original file line numberDiff line numberDiff line change
@@ -462,28 +462,8 @@ For sample alerts that use the common schema, including see
462462

463463
## Alert context fields for activity log alerts
464464

465-
### Administrative Activity Log
466-
467-
|Field |Description |
468-
|---------|---------|
469-
|authorization | |
470-
|action | |
471-
|scope | |
472-
|channels | |
473-
|claims | |
474-
|caller | |
475-
|correlationID | |
476-
|eventSource | |
477-
|eventTimeStamp | |
478-
|eventDataID | |
479-
|level | |
480-
|OperationName | |
481-
|OperationID | |
482-
|status | |
483-
|subStatus | |
484-
|submissionTimeStamp | |
485-
486-
#### Sample activity log alert when the monitoringService = Activity Log - Administrative
465+
See [Azure activity log event schema](../essentials/activity-log-schema.md) for detailed information about the fields in activity log alerts.
466+
### Sample activity log alert when the monitoringService = Activity Log - Administrative
487467

488468
```json
489469
{
@@ -508,34 +488,7 @@ For sample alerts that use the common schema, including see
508488
}
509489
}
510490
```
511-
### Policy Activity Log
512-
513-
|Field |Description |
514-
|---------|---------|
515-
|authorization | |
516-
|action | |
517-
|scope | |
518-
|channels | |
519-
|claims | |
520-
|caller | |
521-
|correlationID | |
522-
|eventSource | |
523-
|eventTimeStamp | |
524-
|eventDataID | |
525-
|level | |
526-
|OperationName | |
527-
|OperationID | |
528-
|properties | |
529-
|description | |
530-
|isComplianceCheck | |
531-
|resourceLocation | |
532-
|ancestors | |
533-
|policies | |
534-
|status | |
535-
|subStatus | |
536-
|submissionTimeStamp | |
537-
538-
#### Sample activity log alert when the monitoringService = Activity Log - Policy
491+
### Sample activity log alert when the monitoringService = Activity Log - Policy
539492

540493
```json
541494
{
@@ -566,33 +519,7 @@ For sample alerts that use the common schema, including see
566519
}
567520
}
568521
```
569-
570-
### Autoscale Activity Log
571-
572-
|Field |Description |
573-
|---------|---------|
574-
|channels | |
575-
|claims | |
576-
|caller | |
577-
|correlationID | |
578-
|eventSource | |
579-
|eventTimeStamp | |
580-
|eventDataID | |
581-
|level | |
582-
|OperationName | |
583-
|OperationID | |
584-
|properties | |
585-
|description | |
586-
|resourceName | |
587-
|oldInstanceCount | |
588-
|newInstanceCount | |
589-
|activeAutoscaleProfile | |
590-
|lastScaleActionTime | |
591-
|status | |
592-
|submissionTimeStamp | |
593-
594-
595-
#### Sample activity log alert when the monitoringService = Activity Log - Autoscale
522+
### Sample activity log alert when the monitoringService = Activity Log - Autoscale
596523

597524
```json
598525
{
@@ -620,35 +547,7 @@ For sample alerts that use the common schema, including see
620547
}
621548
}
622549
```
623-
624-
### Security Activity Log
625-
626-
|Field |Description |
627-
|---------|---------|
628-
|channels | |
629-
|correlationID | |
630-
|eventSource | |
631-
|eventTimeStamp | |
632-
|eventDataID | |
633-
|level | |
634-
|OperationName | |
635-
|OperationID | |
636-
|properties | |
637-
|threatStatus | |
638-
|category | |
639-
|threatID | |
640-
|filePath | |
641-
|protectionType | |
642-
|actionTaken | |
643-
|resourceType | |
644-
|severity | |
645-
|compromisedEntity | |
646-
|remediationSteps | |
647-
|attackedReourceType | |
648-
|status | |
649-
|submissionTimeStamp | |
650-
651-
#### Sample activity log alert when the monitoringService = Activity Log - Security
550+
### Sample activity log alert when the monitoringService = Activity Log - Security
652551

653552
```json
654553
{
@@ -679,45 +578,7 @@ For sample alerts that use the common schema, including see
679578
}
680579
}
681580
```
682-
683-
### Service Health Activity Log
684-
685-
|Field |Description |
686-
|---------|---------|
687-
|authorization | |
688-
|channels | |
689-
|claims | |
690-
|caller | |
691-
|correlationID | |
692-
|eventSource | |
693-
|eventTimeStamp | |
694-
|httpRequest | |
695-
|eventDataID | |
696-
|level | |
697-
|OperationName | |
698-
|OperationID | |
699-
|properties | |
700-
|title | |
701-
|service | |
702-
|region | |
703-
|communication | |
704-
|incidentType | |
705-
|trackingId | |
706-
|impactStartTime | |
707-
|impactMitigationTime | |
708-
|impactedServices | |
709-
|impactedServicesTableRows | |
710-
|defaultLanguageTitle |
711-
|defaultLanguageContent | |
712-
|stage | |
713-
|communicationId | |
714-
|maintenanceId | |
715-
|isHIR | |
716-
|version | |
717-
|status | |
718-
|submissionTimeStamp | |
719-
720-
#### Sample activity log alert when the monitoringService = ServiceHealth
581+
### Sample activity log alert when the monitoringService = ServiceHealth
721582

722583
```json
723584
{
@@ -760,30 +621,7 @@ For sample alerts that use the common schema, including see
760621
}
761622
}
762623
```
763-
764-
### Resource Health Activity Log
765-
766-
|Field |Description |
767-
|---------|---------|
768-
|channels | |
769-
|correlationID | |
770-
|eventSource | |
771-
|eventTimeStamp | |
772-
|eventDataID | |
773-
|level | |
774-
|OperationName | |
775-
|OperationID | |
776-
|properties | |
777-
|title | |
778-
|details | |
779-
|currentHealthStatus | |
780-
|previousHealthStatus | |
781-
|type | |
782-
|cause | |
783-
|status | |
784-
|submissionTimeStamp | |
785-
786-
#### Sample activity log alert when the monitoringService = ResourceHealth
624+
### Sample activity log alert when the monitoringService = ResourceHealth
787625

788626
```json
789627
{
@@ -809,7 +647,6 @@ For sample alerts that use the common schema, including see
809647
}
810648
}
811649
```
812-
813650
## Alert context fields for Prometheus alerts
814651

815652
Field |Description |
@@ -867,7 +704,6 @@ You can also use the [Action Groups API](/rest/api/monitor/actiongroups) to opt
867704
- Set the "useCommonAlertSchema" flag to `true` to enable the common schema
868705
- Set the "useCommonAlertSchema" flag to `false` to use the non-common schema for email, webhook, Logic Apps, Azure Functions, or Automation runbook actions.
869706

870-
871707
#### Sample REST API call for using the common schema
872708

873709
The following [create or update](/rest/api/monitor/actiongroups/createorupdate) REST API request:

0 commit comments

Comments
 (0)