AKS Pod resource utilization (CPU/Memory) alert

How about this:

let cpuusage = materialize(
    Perf
    | where ObjectName == 'K8SContainer'
    | where CounterName has 'cpuUsageNanoCores'
    | extend ContainerNameParts = split(InstanceName, '/')
    | extend ContainerNamePartCount = array_length(ContainerNameParts)             
    | extend PodUIDIndex = ContainerNamePartCount - 2, ContainerNameIndex = ContainerNamePartCount - 1  
    | extend ContainerName = strcat(ContainerNameParts[PodUIDIndex], '/', ContainerNameParts[ContainerNameIndex])
    | summarize AggregatedValue=max(CounterValue) by bin(TimeGenerated, 10m), ContainerName
    | project TimeGenerated, ContainerName, AggregatedValue
);

let cpulimits = materialize(
    Perf
    | where ObjectName == 'K8SContainer'
    | where CounterName == 'cpuLimitNanoCores'
    | extend ContainerNameParts = split(InstanceName, '/')
    | extend ContainerNamePartCount = array_length(ContainerNameParts)             
    | extend PodUIDIndex = ContainerNamePartCount - 2, ContainerNameIndex = ContainerNamePartCount - 1  
    | extend ContainerName = strcat(ContainerNameParts[PodUIDIndex], '/', ContainerNameParts[ContainerNameIndex])
    | extend CpuNanoCoreLimit= CounterValue
    | project ContainerName, CpuNanoCoreLimit
);

let cpu_threshold_exceeded = cpuusage
| join kind=inner cpulimits on ContainerName
| extend CPU_mCores_Usage = AggregatedValue / 1000000
| extend CPU_mCores_Limit = CpuNanoCoreLimit / 1000000
| extend Cpu_Perct_utilization = round((CPU_mCores_Usage / CPU_mCores_Limit) * 100, 2)
| where Cpu_Perct_utilization > 95
| summarize count() by ContainerName, bin(TimeGenerated, 30m)
| where count_ >= 3
| project ContainerName, TimeGenerated, count_;

cpu_threshold_exceeded