Alerting turns monitoring data into an early-warning system. Instead of discovering a failing VM after users complain, define conditions that notify people or trigger automated responses before a small hiccup becomes a full incident. section 3.6.3 section 3.6
Choose the alert type that matches the signal you need:
- Metric alerts watch real-time values such as CPU percentage, disk queue length, or network throughput. They can react quickly to conditions such as CPU remaining above 85 percent for 10 minutes. section 3.6.3
- Log alerts evaluate Kusto Query Language (KQL) results in Log Analytics, making them useful for repeated login failures, anomalies, or application misconfigurations. section 3.6.3
- Activity log alerts detect Azure resource changes, such as deleting a VM or opening RDP access to the public internet. section 3.6.3
- Smart alerts use historical patterns and dynamic thresholds rather than one fixed limit. They can notice an unusual CPU increase even when it misses a static threshold, reducing alert fatigue. section 3.6.3 section 3.8
A VM that raises its digital eyebrows
Suppose a VM normally idles at 20 percent CPU. A static alert set at 85 percent might ignore a sudden rise to 60 percent, while a smart alert can recognize that the behavior is unusual and notify the team. Configure the rule in Azure Monitor by selecting Alerts, creating an alert rule, choosing the VM, selecting the signal and threshold behavior, and attaching an action group. Notifications can reach people or trigger a webhook, Azure Function, or automation runbook. section 3.6.3
Alerting also supports security operations. Microsoft Defender for Cloud raises alerts for detected threats, presents severity and detailed descriptions, and helps prioritize serious findings. Sample alerts can be generated for practice, while the production security-alert service is paid. section 6.4.3
