Alerts - Get All

List all existing alerts, where the results can be filtered on the basis of multiple parameters (e.g. time range). The results can then be sorted on the basis specific fields, with the default being lastModifiedDateTime.

GET https://management.azure.com/{scope}/providers/Microsoft.AlertsManagement/alerts?api-version=2019-03-01
GET https://management.azure.com/{scope}/providers/Microsoft.AlertsManagement/alerts?targetResource={targetResource}&targetResourceType={targetResourceType}&targetResourceGroup={targetResourceGroup}&monitorService={monitorService}&monitorCondition={monitorCondition}&severity={severity}&alertState={alertState}&alertRule={alertRule}&smartGroupId={smartGroupId}&includeContext={includeContext}&includeEgressConfig={includeEgressConfig}&pageCount={pageCount}&sortBy={sortBy}&sortOrder={sortOrder}&select={select}&timeRange={timeRange}&customTimeRange={customTimeRange}&api-version=2019-03-01

URI Parameters

Name In Required Type Description
scope
path True
  • string

scope here is resourceId for which alert is created.

api-version
query True

API version.

alertRule
query
  • string

Filter by specific alert rule. Default value is to select all.

alertState
query

Filter by state of the alert instance. Default value is to select all.

customTimeRange
query
  • string

Filter by custom time range in the format / where time is in (ISO-8601 format)'. Permissible values is within 30 days from query time. Either timeRange or customTimeRange could be used but not both. Default is none.

includeContext
query
  • boolean

Include context which has contextual data specific to the monitor service. Default value is false'

includeEgressConfig
query
  • boolean

Include egress config which would be used for displaying the content in portal. Default value is 'false'.

monitorCondition
query

Filter by monitor condition which is either 'Fired' or 'Resolved'. Default value is to select all.

monitorService
query

Filter by monitor service which generates the alert instance. Default value is select all.

pageCount
query
  • integer

Determines number of alerts returned per page in response. Permissible value is between 1 to 250. When the "includeContent" filter is selected, maximum value allowed is 25. Default value is 25.

select
query
  • string

This filter allows to selection of the fields(comma separated) which would be part of the essential section. This would allow to project only the required fields rather than getting entire content. Default is to fetch all the fields in the essentials section.

severity
query

Filter by severity. Default value is select all.

smartGroupId
query
  • string

Filter the alerts list by the Smart Group Id. Default value is none.

sortBy
query

Sort the query results by input field, Default value is 'lastModifiedDateTime'.

sortOrder
query
  • string

Sort the query results order in either ascending or descending. Default value is 'desc' for time fields and 'asc' for others.

targetResource
query
  • string

Filter by target resource( which is full ARM ID) Default value is select all.

targetResourceGroup
query
  • string

Filter by target resource group name. Default value is select all.

targetResourceType
query
  • string

Filter by target resource type. Default value is select all.

timeRange
query

Filter by time range by below listed values. Default value is 1 day.

Responses

Name Type Description
200 OK

OK. Successfully listed alert objects.

Other Status Codes

Error response describing why the operation failed.

Examples

ListAlerts

Sample Request

GET https://management.azure.com/subscriptions/3b540246-808d-4331-99aa-917b808a9166/providers/Microsoft.AlertsManagement/alerts?api-version=2019-03-01

Sample Response

{
  "nextLink": "https://management.azure.com:443/subscriptions/1e3ff1c0-771a-4119-a03b-be82a51e232d/providers/Microsoft.AlertsManagement/alerts?api-version=2018-05-05-preview&timeRange=1d&ctoken=%2bRID%3aPlwOAPHEGwB9UwEAAAAgCw%3d%3d%23RT%3a2%23TRC%3a500%23RTD%3aqtQyMDE4LTA2LTEyVDE1OjEyOjE1",
  "value": [
    {
      "properties": {
        "essentials": {
          "severity": "Sev3",
          "signalType": "Log",
          "alertState": "Acknowledged",
          "monitorCondition": "Fired",
          "monitorService": "Application Insights",
          "targetResource": "/subscriptions/3b540246-808d-4331-99aa-917b808a9166/resourcegroups/servicedeskresourcegroup/providers/microsoft.insights/components/servicedeskappinsight",
          "targetResourceName": "servicedeskappinsight",
          "targetResourceGroup": "servicedeskresourcegroup",
          "targetResourceType": "components",
          "sourceCreatedId": "6cd6b2ce-8c54-468f-aff0-9d12aebb7e49",
          "smartGroupId": "23d6b2ce-8c54-468f-aff0-sd32aebb7e56",
          "smartGroupingReason": "Occurred frequently with other alerts",
          "alertRule": "https://servisdffsdf.portal.mms.microsoft.com/#Workspace/overview/settings/details/Edit Alert Rule/details/index?savedSearchId=&scheduleId=",
          "startDateTime": "2018-09-13T15:51:02Z",
          "lastModifiedDateTime": "2018-09-13T15:51:02Z",
          "lastModifiedUserName": "System",
          "monitorConditionResolvedDateTime": "2018-09-13T15:51:02Z"
        },
        "egressConfig": {},
        "context": {}
      },
      "id": "/subscriptions/3b540246-808d-4331-99aa-917b808a9166/resourcegroups/servicedeskresourcegroup/providers/microsoft.insights/components/servicedeskappinsight/providers/Microsoft.AlertsManagement/alerts/66114d64-d9d9-478b-95c9-b789d6502100",
      "type": "Microsoft.AlertsManagement/alerts",
      "name": "cpu alert"
    },
    {
      "properties": {
        "essentials": {
          "severity": "Sev3",
          "signalType": "Log",
          "alertState": "New",
          "monitorCondition": "Fired",
          "monitorService": "Application Insights",
          "targetResource": "/subscriptions/3b540246-808d-4331-99aa-917b808a9166/resourcegroups/cind/providers/microsoft.operationalinsights/workspaces/servicedeskwcus",
          "targetResourceName": "servicedeskwcus",
          "targetResourceGroup": "servicedeskresourcegroup",
          "targetResourceType": "components",
          "sourceCreatedId": "6cd6b2ce-8c54-468f-aff0-9d12aebb7e49",
          "smartGroupId": "d1c49c89-ea95-4697-a299-c0f5ebac62f1",
          "smartGroupingReason": "Alerts that frequently occur together have been grouped.",
          "alertRule": "https://servicsdfsdf.portal.mms.microsoft.com/#Workspace/overview/settings/details/Edit Alert Rule/details/index?savedSearchId=&scheduleId=",
          "startDateTime": "2018-09-13T15:51:02Z",
          "lastModifiedDateTime": "2018-09-13T15:51:02Z",
          "lastModifiedUserName": "System",
          "monitorConditionResolvedDateTime": "2018-09-13T15:51:02Z"
        },
        "egressConfig": {},
        "context": {}
      },
      "id": "/subscriptions/3b540246-808d-4331-99aa-917b808a9166/resourcegroups/cind/providers/microsoft.operationalinsights/workspaces/servicedeskwcus/providers/Microsoft.AlertsManagement/alerts/66114d64-d9d9-478b-95c9-b789d6502100",
      "type": "Microsoft.AlertsManagement/alerts",
      "name": "cpu alert"
    }
  ]
}

Definitions

alert

An alert created in alert management service.

alertProperties

Alert property bag

alertsList

List the alerts.

AlertsManagementErrorResponse

An error response from the service.

AlertsSortByFields

Sort the query results by input field, Default value is 'lastModifiedDateTime'.

AlertState

Alert object state, which can be modified by the user.

api-version

API version.

errorResponseBody

Details of error response.

essentials

This object contains consistent fields across different monitor services.

MonitorCondition

Can be 'Fired' or 'Resolved', which represents whether the underlying conditions have crossed the defined alert rule thresholds.

MonitorService

Monitor service on which the rule(monitor) is set.

Severity

Severity of alert Sev0 being highest and Sev4 being lowest.

SignalType

The type of signal the alert is based on, which could be metrics, logs or activity logs.

TimeRange

Filter by time range by below listed values. Default value is 1 day.

alert

An alert created in alert management service.

Name Type Description
id
  • string

Azure resource Id

name
  • string

Azure resource name

properties

Alert property bag

type
  • string

Azure resource type

alertProperties

Alert property bag

Name Type Description
context
  • object

Information specific to the monitor service that gives more contextual details about the alert.

egressConfig
  • object

Config which would be used for displaying the data in portal.

essentials

This object contains consistent fields across different monitor services.

alertsList

List the alerts.

Name Type Description
nextLink
  • string

URL to fetch the next set of alerts.

value

List of alerts

AlertsManagementErrorResponse

An error response from the service.

Name Type Description
error

Details of error response.

AlertsSortByFields

Sort the query results by input field, Default value is 'lastModifiedDateTime'.

Name Type Description
alertState
  • string
lastModifiedDateTime
  • string
monitorCondition
  • string
name
  • string
severity
  • string
startDateTime
  • string
targetResource
  • string
targetResourceGroup
  • string
targetResourceName
  • string
targetResourceType
  • string

AlertState

Alert object state, which can be modified by the user.

Name Type Description
Acknowledged
  • string
Closed
  • string
New
  • string

api-version

API version.

Name Type Description
2018-05-05
  • string

errorResponseBody

Details of error response.

Name Type Description
code
  • string

Error code, intended to be consumed programmatically.

details

A list of additional details about the error.

message
  • string

Description of the error, intended for display in user interface.

target
  • string

Target of the particular error, for example name of the property.

essentials

This object contains consistent fields across different monitor services.

Name Type Description
alertRule
  • string

Rule(monitor) which fired alert instance. Depending on the monitor service, this would be ARM id or name of the rule.

alertState

Alert object state, which can be modified by the user.

lastModifiedDateTime
  • string

Last modification time(ISO-8601 format) of alert instance.

lastModifiedUserName
  • string

User who last modified the alert, in case of monitor service updates user would be 'system', otherwise name of the user.

monitorCondition

Can be 'Fired' or 'Resolved', which represents whether the underlying conditions have crossed the defined alert rule thresholds.

monitorConditionResolvedDateTime
  • string

Resolved time(ISO-8601 format) of alert instance. This will be updated when monitor service resolves the alert instance because the rule condition is no longer met.

monitorService

Monitor service on which the rule(monitor) is set.

severity

Severity of alert Sev0 being highest and Sev4 being lowest.

signalType

The type of signal the alert is based on, which could be metrics, logs or activity logs.

smartGroupId
  • string

Unique Id of the smart group

smartGroupingReason
  • string

Verbose reason describing the reason why this alert instance is added to a smart group

sourceCreatedId
  • string

Unique Id created by monitor service for each alert instance. This could be used to track the issue at the monitor service, in case of Nagios, Zabbix, SCOM etc.

startDateTime
  • string

Creation time(ISO-8601 format) of alert instance.

targetResource
  • string

Target ARM resource, on which alert got created.

targetResourceGroup
  • string

Resource group of target ARM resource, on which alert got created.

targetResourceName
  • string

Name of the target ARM resource name, on which alert got created.

targetResourceType
  • string

Resource type of target ARM resource, on which alert got created.

MonitorCondition

Can be 'Fired' or 'Resolved', which represents whether the underlying conditions have crossed the defined alert rule thresholds.

Name Type Description
Fired
  • string
Resolved
  • string

MonitorService

Monitor service on which the rule(monitor) is set.

Name Type Description
ActivityLog Administrative
  • string
ActivityLog Autoscale
  • string
ActivityLog Policy
  • string
ActivityLog Recommendation
  • string
ActivityLog Security
  • string
Application Insights
  • string
Log Analytics
  • string
Nagios
  • string
Platform
  • string
Resource Health
  • string
SCOM
  • string
ServiceHealth
  • string
SmartDetector
  • string
VM Insights
  • string
Zabbix
  • string

Severity

Severity of alert Sev0 being highest and Sev4 being lowest.

Name Type Description
Sev0
  • string
Sev1
  • string
Sev2
  • string
Sev3
  • string
Sev4
  • string

SignalType

The type of signal the alert is based on, which could be metrics, logs or activity logs.

Name Type Description
Log
  • string
Metric
  • string
Unknown
  • string

TimeRange

Filter by time range by below listed values. Default value is 1 day.

Name Type Description
1d
  • string
1h
  • string
30d
  • string
7d
  • string