Azure Monitor Baseline Alerts
Download AlertsGlossaryGitHubGitHub IssuesToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Policy Initiatives

Overview

This document details the ALZ-Monitor Azure policy initiatives leveraged for deploying the ALZ-Monitor baselines. For references on individual alerts/policies, refer to Alert Details.

Connectivity initiative

This initiative is intended for assignment of policies relevant to networking components in ALZ. With the guidance provided in Introduction to deploying the ALZ Pattern, this will assign to the alz-platform-connectivity management group structure in the ALZ reference architecture. For details on which policies are included in the initiative as well as what the default enablement state of the policy is, refer to the below table.

Policy NamePolicy Reference IDPath to policy json filePolicy default effect
Deploy ExpressRoute Circuits QosDropBitsInPerSecond AlertALZ_ERCIRQoSDropBitsinPerSecdeploy-ercir_qosdropsbitsin_alert.jsondeployIfNotExists
Deploy ExpressRoute Circuits QosDropBitsOutPerSecond AlertALZ_ERCIRQoSDropBitsoutPerSecdeploy-ercir_qosdropsbitsout_alert.jsondeployIfNotExists
Deploy ER Direct ExpressRoute Bits In AlertALZ_ERPBitsInPerSeconddeploy-erp-bitsinpersecond-alert.jsondeployIfNotExists
Deploy ER Direct ExpressRoute Bits Out AlertALZ_ERPBitsOutPerSeconddeploy-erp-bitsoutpersecond-alert.jsondeployIfNotExists
Deploy ER Direct ExpressRoute LineProtocol AlertALZ_ERPLineProtocoldeploy-erp-lineprotocol-alert.jsondeployIfNotExists
Deploy ER Direct ExpressRoute RxLightLevel High AlertALZ_ERPRxLightLevelHighdeploy-erp-rxlightlevelhigh-alert.jsondeployIfNotExists
Deploy ER Direct ExpressRoute RxLightLevel Low AlertALZ_ERPRxLightLevelLowdeploy-erp-rxlightlevellow-alert.jsondeployIfNotExists
Deploy ER Direct ExpressRoute TxLightLevel High AlertALZ_ERPTxLightLevelHighdeploy-erp-txlightlevelhigh-alert.jsondeployIfNotExists
Deploy ER Direct ExpressRoute TxLightLevel Low AlertALZ_ERPTxLightLevelLowdeploy-erp-txlightlevellow-alert.jsondeployIfNotExists
Deploy VPNG BGP Peer Status AlertALZ_VPNGwBGPPeerStatusdeploy-vpng_bgppeerstatus_alert.jsondeployIfNotExists
Deploy VNetG ExpressRoute CPU Utilization AlertALZ_VnetGwERCpuUtildeploy-vnetg_expressroutecpuutilization_alert.jsondeployIfNotExists
Deploy VNetG Tunnel Bandwidth AlertALZ_VnetGwTunnelBWdeploy-vnetg_bandwidthutilization_alert.jsondeployIfNotExists
Deploy VNetG Tunnel Egress AlertALZ_VnetGwTunnelEgressdeploy-vnetg_egress_alert.jsondisabled
Deploy VNetG Tunnel Ingress AlertALZ_VnetGwTunnelIngressdeploy-vnetg_ingress_alert.jsondisabled
Deploy_VPNGw_BandwidthUtil_AlertALZ_VPNGWBandWidthUtildeploy-vpng_bandwidthutilization_alert.jsondeployIfNotExists
Deploy VPNG Egress AlertALZ_VPNGWEgressdeploy-vpng_egress_alert.jsondisabled
Deploy VPNG Egress Packet Drop Count AlertALZ_VPNGWTunnelEgressPacketDropCountdeploy-vpng_egresspacketdropcount_alert.jsondeployIfNotExists
Deploy VPNG Egress Packet Drop Mismatch AlertALZ_VPNGWTunnelEgressPacketDropMismatchdeploy-vpng_egresspacketdropmismatch_alert.jsondeployIfNotExists
Deploy VPNG Ingress AlertALZ_VPNGWIngressdeploy-vpng_ingress_alert.jsondisabled
Deploy VPNG Ingress Packet Drop Count AlertALZ_VPNGWTunnelIngressPacketDropCountdeploy-vpng_ingresspacketdropcount_alert.jsondeployIfNotExists
Deploy VPNG Ingress Packet Drop Mismatch AlertALZ_VPNGWTunnelIngressPacketDropMismatchdeploy-vpng_ingresspacketdropmismatch_alert.jsondeployIfNotExists
Deploy PDNSZ Capacity Utilization AlertALZ_PDNSZCapacityUtildeploy-pdnsz_capacityutilization_alert.jsondeployIfNotExists
Deploy PDNSZ Query Volume AlertALZ_PDNSZQueryVolumedeploy-pdnsz_queryvolume_alert.jsondisabled
Deploy PDNSZ Record Set Capacity AlertALZ_PDNSZRecordSetCapacitydeploy-pdnsz_recordsetcapacity_alert.jsondeployIfNotExists
Deploy PDNSZ Registration Capacity Utilization AlertALZ_PDNSZRegistrationCapacityUtildeploy-pdnsz_registrationcapacityutilization_alert.jsondeployIfNotExists
Deploy ERG ExpressRoute Bits In AlertALZ_ERGwExpressRouteBitsIndeploy-erg_bitsinpersecond_alert.jsondisabled
Deploy ERG ExpressRoute Bits Out AlertALZ_ERGwExpressRouteBitsOutdeploy-erg_bitsoutpersecond_alert.jsondisabled
Deploy ERG ExpressRoute CPU Utilization AlertALZ_ERGwExpressRouteCpuUtildeploy-erg_expressroutecpuutilization_alert.jsondeployIfNotExists
Deploy VNetG Egress Packet Drop Mismatch AlertALZ_VnetGwTunnelEgressPacketDropMismatchdeploy-vnetg_egresspacketdropmismatch_alert.jsondeployIfNotExists
Deploy VNetG ExpressRoute Bits Per Second AlertALZ_VnetGwExpressRouteBitsPerSeconddeploy-vnetg_expressroutebitspersecond_alert.jsondeployIfNotExists
Deploy VNetG Ingress Packet Drop Mismatch AlertALZ_VnetGwTunnelIngressPacketDropMismatchdeploy-vnetg_ingresspacketdropmismatch_alert.jsondeployIfNotExists
Deploy VNetG Ingress Packet Drop Count AlertALZ_VnetGwTunnelIngressPacketDropCountdeploy-vnetg_ingresspacketdropcount_alert.jsondeployIfNotExists
Deploy VNetG Egress Packet Drop Count AlertALZ_VnetGwTunnelEgressPacketDropCountdeploy-vnetg_ingresspacketdropcount_alert.jsondeployIfNotExists
Deploy ExpressRoute Circuits Bgp Availability AlertALZ_ERCIRBgpAvailabilitydeploy-ercir_bgpavailability_alert.jsondeployIfNotExists
Deploy ExpressRoute Circuits Arp Availability AlertALZ_ERCIRArpAvailabilitydeploy-ercir_arpavailability_alert.jsondeployIfNotExists
Deploy AFW SNATPortUtilization AlertALZ_AFWSNATPortUtilizationdeploy-afw_snatportutilization_alert.jsondeployIfNotExists
Deploy AFW FirewallHealth AlertALZ_FirewallHealthdeploy-afw_firewallhealth_alertdeployIfNotExists
Deploy PIP Bytes in DDoS Attack AlertALZ_PIPBytesInDDoSEvaluationFrequencydeploy-pip_bytesinddosattack_alert.jsondisabled
Deploy PIP DDoS Attack AlertALZ_PIPDDoSAttackdeploy-pip_ddosattack_alert.jsondeployIfNotExists
Deploy PIP Packets in DDoS Attack AlertALZ_PIPPacketsInDDoSdeploy-pip_packetsinddos_alert.jsondisabled
Deploy PIP VIP Availability AlertALZ_PIPVIPAvailabilitydeploy-pip_vipavailability_alert.jsondeployIfNotExists
Deploy VNet DDoS Attack AlertALZ_VNETDDOSAttackdeploy-vnet_ddosattack_alert.jsondeployIfNotExists
Deploy ALB Data Path Availability AlertALZ_LBDataPathAvailabilityDeploy-LB-DatapathAvailability-Alert.jsondeployIfNotExists
Deploy ALB Global Backend Availability AlertALZ_LBGlobalBackendAvailabilityDeploy-LB-GlobalBackendAvailability-Alert.jsondeployIfNotExists
Deploy ALB Health Probe Status AlertALZ_LBHealthProbeStatusDeploy-LB-HealthProbeStatus-Alert.jsondeployIfNotExists
Deploy ALB Used SNAT Ports AlertALZ_LBUsedSNATPortsDeploy-LB-UsedSNATPorts-Alert.jsondeployIfNotExists
Deploy Activity Log Azure FireWall Delete AlertALZ_activityFWDeletedeploy-activitylog-AzureFirewall-Del.jsondeployIfNotExists
Deploy Activity Log Route Table Update AlertDeploy_activitylog_RouteTable_Updatedeploy-activitylog-RouteTable-Update.jsondeployIfNotExists
Deploy Activity Log NSG Delete AlertALZ_activityNSGDeletedeploy-activitylog-NSG-Del.jsondeployIfNotExists
Deploy Activity Log VPN Gateway Delete AlertALZ_activityVPNGWDeletedeploy-activitylog-VPNGate-Del.jsondeployIfNotExists

Management initiative

This initiative is intended for assignment of policies relevant to management components in ALZ. With the guidance provided in Introduction to deploying the ALZ Pattern, this will assign to the alz-platform-management group structure in the ALZ reference architecture. For details on which policies are included in the initiative as well as what the default enablement state of the policy is, refer to the below table.

Policy NamePolicy Reference IDPath to policy json filePolicy default effect
Deploy Automation Account TotalJob AlertALZ_AATotalJobdeploy-aa_totaljob_alert.jsondeployIfNotExists
Deploy RV Backup Health Monitoring AlertsALZ_RVBackupHealthdeploy-rv_backuphealth_alert.jsonmodify
Deploy SA Availability AlertALZ_StorageAccountAvailabilitydeploy-sa_availability_alert.jsondeployIfNotExists
Deploy Activity Log Storage Account Delete AlertALZ_activitySADeleteDeploy_activitylog_StorageAccount_Delete.jsondeployIfNotExists
Deploy Activity Log LA Workspace Delete AlertALZ_activityLAWDeletedeploy-activitylog-LAWorkspace-Del.jsondeployIfNotExists
Deploy Activity Log LA Workspace Regenerate Key AlertALZ_activityLAWKeyRegendeploy-activitylog-LAWorkspace-ReGen.jsondeployIfNotExists

Identity initiative

This initiative is intended for assignment of policies relevant to identity components in ALZ. With the guidance provided in Introduction to deploying the ALZ Pattern, this will assign to the alz-platform-identity management group structure in the ALZ reference architecture. For details on which policies are included in the initiative as well as what the default enablement state of the policy is, refer to the below table.

Policy NamePolicy Reference IDPath to policy json filePolicy default effect
Deploy KeyVault Requests AlertALZ_KVRequestdeploy-kv_requests_alert.jsondisabled
Deploy Activity Log Storage Account Delete AlertALZ_activitySADeleteDeploy_activitylog_StorageAccount_Delete.jsondeployIfNotExists
Deploy KeyVault Availability AlertALZ_KvAvailabilitydeploy-kv_availability_alert.jsondisabled
Deploy KeyVault Latency AlertALZ_KvLatencyAvailabilitydeploy-kv_latency_alert.jsondisabled
Deploy KeyVault Capacity AlertALZ_KVCapacitydeploy-kv_capacity_alert.jsondisabled
Deploy Activity Log Key Vault Delete AlertALZ_activityKVDeletedeploy-activitylog-KeyVault-Del.jsondeployIfNotExists

Landing Zone initiative

This initiative is intended for assignment of policies relevant to a landing zone in the ALZ structure. With the guidance provided in Introduction to deploying the ALZ Pattern this will be assigned to the Landing Zones management group in the ALZ reference architecture. For details on which policies are included in the initiative as well as what the default enablement state of the policy is, refer to the below table.

Policy NamePolicy Reference IDPath to policy .json filePolicy default effect
Deploy SA Availability AlertALZ_StorageAccountAvailabilitydeploy-sa_availability_alert.jsondeployIfNotExists
Deploy KeyVault Requests AlertALZ_KVRequestdeploy-kv_requests_alert.jsondisabled
Deploy KeyVault Availability AlertALZ_KvAvailabilitydeploy-kv_availability_alert.jsondeployIfNotExists-
Deploy KeyVault Latency AlertALZ_KvLatencyAvailabilitydeploy-kv_latency_alert.jsondeployIfNotExists
Deploy KeyVault Capacity AlertALZ_KVCapacitydeploy-kv_capacity_alert.jsondeployIfNotExists
Deploy Activity Log Key Vault Delete AlertALZ_activityKVDeletedeploy-activitylog-KeyVault-Del.jsondeployIfNotExists
Deploy Activity Log Route Table Update AlertALZ_activityUDRUpdatedeploy-activitylog-RouteTable-Update.jsondeployIfNotExists
Deploy Activity Log NSG Delete AlertALZ_activityNSGDeletedeploy-activitylog-NSG-Del.jsondeployIfNotExists
Deploy PIP Bytes in DDoS Attack AlertALZ_PIPBytesInDDoSdeploy-pip_bytesinddosattack_alert.jsondisabled
Deploy PIP DDoS Attack AlertALZ_PIPDDoSAttackdeploy-pip_ddosattack_alert.jsondeployIfNotExists
Deploy PIP Packets in DDoS Attack AlertALZ_PIPPacketsInDDoSdeploy-pip_packetsinddos_alert.jsondisabled
Deploy PIP VIP Availability AlertALZ_PIPVIPAvailabilitydeploy-pip_vipavailability_alert.jsondeployIfNotExists
Deploy VNet DDoS Attack AlertALZ_VNETDDOSAttackdeploy-vnet_ddosattack_alert.jsondeployIfNotExists
Deploy RV Backup Health Monitoring AlertsALZ_RVBackupHealthMonitordeploy-rv_backuphealth_monitor.jsonmodify
Deploy VM HeartBeat AlertALZ_VMHeartBeatRGdeploy-vm-HeartBeat_alert.jsondeployIfNotExists
Deploy VM Network Read AlertALZ_VMNetworkIndeploy-vm-NetworkIn_alert.jsondeployIfNotExists
Deploy VM Network Write AlertALZ_VMNetworkOutdeploy-vm-NetworkOut_alert.jsondeployIfNotExists
Deploy VM OS Disk Read Latency AlertALZ_VMOSDiskReadLatencydeploy-vm-OSDiskreadLatency_alert.jsondeployIfNotExists
Deploy VM OS Disk Write Latency AlertALZ_VMOSDiskWriteLatencydeploy-vm-OSDiskwriteLatency_alert.jsondeployIfNotExists
Deploy VM OS Disk Space AlertALZ_VMOSDiskSpacedeploy-vm-OSDiskSpace_alert.jsondeployIfNotExists
Deploy VM CPU AlertALZ_VMPercentCPUdeploy-vm-PercentCPU_alert.jsondeployIfNotExists
Deploy VM Memory AlertALZ_VMPercentMemorydeploy-vm-PercentMemory_alert.jsondeployIfNotExists
Deploy VM Data Disk Space AlertALZ_VMDataDiskSpacedeploy-vm-dataDiskSpace_alert.jsondeployIfNotExists
Deploy VM Data Disk Read Latency AlertALZ_VMDataDiskReadLatencydeploy-vm-dataDiskreadLatency_alert.jsondeployIfNotExists
Deploy VM Data Disk Write Latency AlertALZ_VMDataDiskWriteLatencydeploy-vm-dataDiskwriteLatency_alert.jsondeployIfNotExists
Deploy AGW ApplicationGatewayTotalTime AlertALZ_AGWTotalTimeDeploy-AGW-ApplicationGatewayTotalTime-Alert.jsondeployIfNotExists
Deploy AGW BackendLastByteResponseTime AlertALZ_AGWBackendLastByteResponseTimeDeploy-AGW-BackendLastByteResponseTime-Alert.jsondeployIfNotExists
Deploy AGW Capacity Units AlertALZ_AGWCapacityUnitsDeploy-AGW-CapacityUnits-Alert.jsondeployIfNotExists
Deploy AGW Compute Units AlertALZ_AGWComputeUnitsDeploy-AGW-ComputeUnits-Alert.jsondeployIfNotExists
Deploy AGW CPU Utilization AlertALZ_AGWCPUUtilizationDeploy-AGW-CPUUtil-Alert.jsondeployIfNotExists
Deploy AGW FailedRequests AlertALZ_AGWFailedRequestsDeploy-AGW-FailedRequests-Alert.jsondeployIfNotExists
Deploy AGW ResponseStatus AlertALZ_AGWResponseStatusDeploy-AGW-ResponseStatus-Alert.jsondeployIfNotExists
Deploy AGW Unhealthy Host Count AlertALZ_AGWUnhealthyHostCountDeploy-AGW-UnhealthyHostCount-Alert.jsondeployIfNotExists
Deploy ALB Data Path Availability AlertALZ_LBDataPathAvailabilityDeploy-LB-DatapathAvailability-Alert.jsondeployIfNotExists
Deploy ALB Global Backend Availability AlertALZ_LBGlobalBackendAvailabilityDeploy-LB-GlobalBackendAvailability-Alert.jsondeployIfNotExists
Deploy ALB Health Probe Status AlertALZ_LBHealthProbeStatusDeploy-LB-HealthProbeStatus-Alert.jsondeployIfNotExists
Deploy ALB Used SNAT Ports AlertALZ_LBUsedSNATPortsDeploy-LB-HealthProbeStatus-Alert.jsondeployIfNotExists
Deploy FrontDoor CDN Profile Origin Health Percentage AlertALZ_CDNPOriginHealthPercentageDeploy-CDNP-OriginHealthPercentage-Alert.jsondeployIfNotExists
Deploy FrontDoor CDN Profile Origin Latency AlertALZ_CDNPOriginLatencyDeploy-CDNP-OriginLatency-Alert.jsondeployIfNotExists
Deploy FrontDoor CDN Profile Percentage4XX AlertALZ_CDNPPercentage4XXDeploy-CDNP-Percentage4XX-Alert.jsondeployIfNotExists
Deploy FrontDoor CDN Profile Percentage5XX AlertALZ_CDNPPercentage5XXDeploy-CDNP-Percentage5XX-Alert.jsondeployIfNotExists
Deploy Traffic Manager Endpoint Health AlertALZ_TMEndpointHealthDeploy-TM-EndpointHealth-Alert.jsondeployIfNotExists
Deploy App Service Plan CPU Percentage AlertALZ_WSFCPUPercentageDeploy-WSF-CPUPercentage-Alert.jsondeployIfNotExists
Deploy App Service Plan Memory Percentage AlertALZ_WSFMemoryPercentageDeploy-WSF-MemoryPercentage-Alert.jsondeployIfNotExists
Deploy App Service Plan Disk Queue Length AlertALZ_WSFDiskQueueLengthDeploy-WSF-DiskQueueLength-Alert.jsondeployIfNotExists
Deploy App Service Plan Http Queue Length AlertALZ_WSFHttpQueueLengthDeploy-WSF-HttpQueueLength-Alert.jsondeployIfNotExists
Deploy Frontdoor Backend Health Percentage AlertALZ_FDBackendHealthDeploy-FD-BackendHealth-Alert.jsondeployIfNotExists
Deploy Frontdoor Backend Request Latency AlertALZ_FDBackendRequestLatencyDeploy-FD-BackendRequestLatency-Alert.jsondeployIfNotExists

Hybrid VM initiative

This initiative is intended for assignment of policies relevant to Hybrid VM alerts in AMBA-ALZ. With the guidance provided in Introduction to deploying the ALZ Pattern, this will be assigned to the ‘alz’ intermediate root management group structure in the ALZ reference architecture. For details on which policies are included in the initiative as well as what the default policy effect is, refer to the below table.

Policy Display NameReference IDPath to policy json filePolicy default effect
Deploy Hybrid VM CPU AlertALZ_HybridVMPercentCPUDeploy-Hybrid-VM-PercentCPU-AlertdeployIfNotExists
Deploy Hybrid VM Data Disk Read Latency AlertALZ_HybridVMDataDiskReadLatencyDeploy-Hybrid-VM-DataDiskReadLatency-AlertdeployIfNotExists
Deploy Hybrid VM Data Disk Space AlertALZ_HybridVMDataDiskSpaceDeploy-Hybrid-VM-DataDiskSpace-AlertdeployIfNotExists
Deploy Hybrid VM Data Disk Write Latency AlertALZ_HybridVMDataDiskWriteLatencyDeploy-Hybrid-VM-DataDiskWriteLatency-AlertdeployIfNotExists
Deploy Hybrid VM Disconnected AlertALZ_HybridVMDisconnectedDeploy-Hybrid-VM-Disconnected-AlertdeployIfNotExists
Deploy Hybrid VM HeartBeat AlertALZ_HybridVMHeartBeatRGDeploy-Hybrid-VM-HeartBeatAlertRGdeployIfNotExists
Deploy Hybrid VM Memory AlertALZ_HybridVMPercentMemoryDeploy-Hybrid-VM-PercentMemory-AlertdeployIfNotExists
Deploy Hybrid VM Network Read AlertALZ_HybridVMNetworkInDeploy-Hybrid-VM-NetworkIn-AlertdeployIfNotExists
Deploy Hybrid VM Network Write AlertALZ_HybridVMNetworkOutDeploy-Hybrid-VM-NetworkOut-AlertdeployIfNotExists
Deploy Hybrid VM OS Disk Read Latency AlertALZ_HybridVMOSDiskReadLatencyDeploy-Hybrid-VM-OSDiskReadLatency-AlertdeployIfNotExists
Deploy Hybrid VM OS Disk Space AlertALZ_HybridVMOSDiskSpaceDeploy-Hybrid-VM-OSDiskSpace-AlertdeployIfNotExists
Deploy Hybrid VM OS Disk Write Latency AlertALZ_HybridVMOSDiskWriteLatencyDeploy-Hybrid-VM-OSDiskWriteLatency-AlertdeployIfNotExists

Service Health initiative

This initiative is intended for assignment of policies relevant to service health alerts in ALZ. With the guidance provided in Introduction to deploying the ALZ Pattern, this will assign to the alz intermediate root management group structure in the ALZ reference architecture. For details on which policies are included in the initiative as well as what the default enablement state of the policy is, refer to the below table.

Policy NamePolicy Reference IDPath to policy json filePolicy default effect
Deploy Service Health Security Advisory AlertALZ_svcHlthSecAdvisorydeploy-activitylog-ServiceHealth-Security.jsondeployIfNotExists
Deploy Resource Health Unhealthy AlertALZ_ResHlthUnhealthydeploy-activitylog-ResourceHealth-UnHealthly-alert.jsondeployIfNotExists
Deploy Service Health Advisory AlertALZ_SvcHlthAdvisorydeploy-activitylog-ServiceHealth-Health.jsondeployIfNotExists
Deploy Service Health Incident AlertALZ_SvcHlthIncidentdeploy-activitylog-ServiceHealth-Incident.jsondeployIfNotExists
Deploy Service Health Maintenance AlertALZ_SvcHlthMaintenancedeploy-activitylog-ServiceHealth-Maintenance.jsondeployIfNotExists
Deploy Service Health Action GroupALZ_ServiceHealth_ActionGroupsdeploy-ServiceHealth-ActionGroups.jsondeployIfNotExists

Notification Assets initiative

This initiative is intended for assignment of policies relevant to notification in AMBA-ALZ. With the guidance provided in Introduction to deploying the ALZ Pattern, this will assign to the alz intermediate root management group structure in the ALZ reference architecture. For details on which policies are included in the initiative as well as what the default enablement state of the policy is, refer to the below table.

Policy Display NameReference IDPath to policy json filePolicy default effect
Deploy AMBA Notification AssetsALZ_AlertProcessing_Ruledeploy-AlertProcessingRule-deploy.jsondeployIfNotExists
Deploy AMBA Notification Suppression AssetALZ_Suppression_AlertProcessing_Ruledeploy-AlertProcessingRule-Suppression.jsondeployIfNotExists