Forum Discussion
Create Azure Alert for deleted virtual machines with the IP address for each VM as output
Hello everyone, I just want to ask if anyone know if is possible to create an azure alert for deleted virtual machines that displays the IP address of the virtual machine that has been deleted. I kno...
How is the alert setup, a screen shot will help. Also you should be able to join on the name of the resource (this is an example only)
AzureActivity
| where ResourceProviderValue == "MICROSOFT.COMPUTE"
| where OperationNameValue == "MICROSOFT.COMPUTE/VIRTUALMACHINES/DELETE"
| extend Computer = tostring(parse_json(Properties).resource)
| join kind=inner
(
Heartbeat
| project Computer, ComputerIP, ResourceId
) on Computer
AzureActivity
| where ResourceProviderValue == "MICROSOFT.COMPUTE"
| where OperationNameValue == "MICROSOFT.COMPUTE/VIRTUALMACHINES/DELETE"
| extend Computer = tostring(parse_json(Properties).resource)
| join kind=inner
(
Heartbeat
| project Computer, ComputerIP, ResourceId
) on Computer
Hi Clive_Watson, I made the changes you recommended about adding the name of the resource, when I run the query, I am getting data but the alert still not firing.
