Hello,
Does someone know the query to retrieve the different alerts like shown in the picture here below?
Hi @dentom,
In order to retrieve all the alerts in this page we are querying ARG.
If I understand currently you are referring to how we are getting the count of the alerts by severity. For that we are using ARG Facets options:
The facets will return the summarize count by the given expression for all the results (even when using pagination it will take into account the full available results and not only current page).
ARG example:
alertsmanagementresources
| project name, subscriptionId, Severity_ = tostring(properties.context.SeverityDescription), TimeGenerated_ = todatetime(properties.essentials.startDateTime), properties
| where TimeGenerated_ > ago(30d) // and subscriptionId == '< insert your ID here>'
| where isnotempty(Severity_)
| summarize count() by Severity_, subscriptionId
