Include asset tags in Azure Monitor alerts

Yes, it is possible to include tags in Azure Monitor alerts by using Azure Logic Apps or Azure Functions to enrich the alert payload with the resource tags.

Here’s a step-by-step approach to accomplish this:

1. Create the Azure Monitor Alert:

   • Set up your alert rule in Azure Monitor based on your criteria.

2. Trigger a Logic App or Azure Function:

   • Configure the alert to trigger an Azure Logic App or an Azure Function. This can be done in the "Actions" section of the alert rule, where you can specify an Action Group to call a Logic App or Function.

3. Retrieve Resource Tags:

   • In your Logic App or Azure Function, use Azure Resource Manager (ARM) REST API to get the tags for the resource. This can be done by making an HTTP request to the ARM endpoint for the resource.

   For Logic Apps:

   • Use the HTTP action to call the ARM REST API.

   For Azure Functions:

   • Use the appropriate SDK or HTTP client to call the ARM REST API.

4. Enrich the Alert Payload:

   • Extract the tags from the ARM response and append them to the alert payload.

Example in a Logic App:

json

{
"actions": [
{
"call": {
"method": "GET",
"uri": "https://management.azure.com/{resourceId}?api-version=2021-04-01",
"headers": {
"Authorization": "Bearer {token}"
}
},
"extract": {
"path": "$.tags"
},
"compose": {
"inputs": {
"tags": "@body('HTTP')['tags']"
}
}
}
]
}

5. Notify or Act on the Enriched Alert:

• Send the enriched alert payload to your desired endpoint (email, SMS, ITSM system, etc.) using the appropriate actions in your Logic App or Azure Function.

By following these steps, you can include the tags configured on the resource in the Azure Monitor alert payload. This approach allows you to have more context about the resource when an alert is triggered.

odallal 

odallal 

Hi Ohad,

Currently, if you want to enrich the alert with the resource tag, you will need to do it yourself, for example - using a Logic App action in the action group.

We are considering adding this functionality out-of-the-box later in 2021.

Thanks,

   Ofir