Blog Post

FastTrack for Azure
6 MIN READ

Generate Azure Policy Compliance Alerts By Sending Custom Data to Log Analytics - Part 2 - Automated

DJBartles's avatar
DJBartles
Icon for Microsoft rankMicrosoft
Feb 09, 2024
Purpose This article is Part 2 of the series that shows you how to setup alerting when an Azure Policy Compliance State changes.  Part 1 of this article (https://techcommunity.microsoft.com/t5/fast...
Updated Feb 09, 2024
Version 1.0
governance
Infra
security
DJBartles's avatar
DJBartles
Icon for Microsoft rankMicrosoft
Aug 20, 2024

The Event Hub is where the basic filtering is setup for what data is captured.  As I recall, there are 3 different PolicyInsights data feeds, which this article recommends selecting 2 of those 3.  There are additional filters at the Event Hub Subscription level but I do not think we implement any of those in this article.  I do not know how PolicyInsights data would publish data for resources that do not exist.  Why do you say the data shows the wrong compliance state?  Also, I do not understand your comment about "wrong RG under subject".

 

I am not sure I completely understand the problem you are having but I don't think I have seen anything like you describe.  Essentially, the Event Hub Subscription published the data and the Function pushes that data into Log Analytics.  The data can be filtered at the Event Hub Subscription level OR the Azure Function code level.  My approach in these articles has been to send the data into the LAW and then you can use refined queries to pull the data you need.