Create Azure Alert Rules using Signals

[simone-cw]

The article Create a new alert rule in the Azure portal shows how to create a new alert rule using the available signals.

For example, by selecting a subscription as the scope, the Azure Portal presents the Signal "Failover Azure SQL Database Failover Group" (last one in the list below), among many others.

A rule created using that signal has the following ARM template (obtained from the Azure Portal).

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {},
    "variables": {},
    "resources": [
        {
            "type": "microsoft.insights/activityLogAlerts",
            "apiVersion": "2020-10-01",
            "name": "TestRule",
            "location": "Global",
            "properties": {
                "scopes": [
                    "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
                ],
                "condition": {
                    "allOf": [
                        {
                            "field": "category",
                            "equals": "Administrative"
                        },
                        {
                            "field": "operationName",
                            "equals": "Microsoft.Sql/servers/failoverGroups/failover/action"
                        }
                    ]
                },
                "actions": {
                    "actionGroups": [
                        {
                            "actionGroupId": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourcegroups/rg-xxxxxxxx/providers/microsoft.insights/actiongroups/testactiongroup",
                            "webhookProperties": {}
                        }
                    ]
                },
                "enabled": true
            }
        }
    ]
}

I've been able to reproduce the rule using the code below. However, this is very time consuming as, to find out the conditions that make up the signal, I first need to manually create a rule through the Azure Portal.

$condition1 = New-AzActivityLogAlertCondition -Field 'category' -Equal 'Administrative'
$condition2 = New-AzActivityLogAlertCondition -Field 'operationName' -Equal 'Microsoft.Sql/servers/failoverGroups/failover/action'
$conditions = $($condition1, $condition2);
$actionGroup = Get-AzActionGroup -Name "testactiongroup" -ResourceGroupName "rg-xxxxxxxx"

$params = @{
    Location          = "Global";
    Name              = "TestRule";
    ResourceGroupName = "rg-xxxxxxxx";
    Scope             = "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx";
    Action            = New-AzActionGroup -ActionGroupId $actionGroup.Id;
    Condition         = $conditions;
}

Set-AzActivityLogAlert @params

Now to my questions.
When creating an Alert Rule through the Az module (e.g. Set-AzActivityLogAlert) is there a way to specify a Signal with pre-configured condition, just as it is possible through the portal?
Alternatively, if there's no direct way to specify the signal in input, is there a way to retrieve the properties related to a signal (e.g. conditions) so that then I can reuse them to replicate the same conditions (e.g. using New-AzActivityLogAlertCondition)?

[dingmeng-xue]

@simone-cw , I believe it's not easy to client tool because it seems signal definition and mapping to ARM template are implemented in Portal extension. We will follow up and confirm our thought. If service has API for signal, it will be easy to us.

[dingmeng-xue]

@VeryEarly @Alex-wdy FYI

[simone-cw]

Thanks @dingmeng-xue
If you do find an API to get this information, please let me know. I'd be happy to use that API while waiting for the actual implementation in the Az module.

[Alex-wdy]

I will check with the portal team to see if there is such an API

[simone-cw]

@Alex-wdy Is there any update?

[Alex-wdy]

We got some feedback from the service team and are analyzing whether it can be implemented, once the analysis is complete, we will let you know the plan

[dingmeng-xue]

We will discuss this feature during planning. Close this discussion now.