Azure Service Health Action Notifications

AzureActivity | where OperationNameValue contains "Microsoft.ServiceHealth/informational/action" | extend ParsedProperties = parse_json(Properties) | extend Title = ParsedProperties.['title'], Service = ParsedProperties.['service'], Region = ParsedProperties.['region'], Communication = ParsedProperties.['communication'], incidentType = ParsedProperties.['incidentType'] | project-reorder Level, ActivityStatus, Title, SubscriptionId, Service, Region, Communication, incidentType

Query Information

Description

Detects Azure Service Health informational action notifications from AzureActivity and extracts key fields from Properties for triage and operational follow-up.

References

Explanation

This query is designed to identify and extract specific information from Azure Service Health notifications that are classified as informational actions. Here's a simple breakdown of what the query does:

Source Data: It starts by looking at the AzureActivity log, which contains records of various activities and events in Azure.
Filter: It filters the data to find entries where the OperationNameValue includes "Microsoft.ServiceHealth/informational/action". This means it's specifically looking for informational notifications related to Azure Service Health.
Extract Information: The query then extracts detailed information from the Properties field of these entries. It parses this field as JSON to pull out specific pieces of information:
- Title: The title of the notification.
- Service: The Azure service that the notification pertains to.
- Region: The geographical region affected by the notification.
- Communication: Details about the communication or message.
- incidentType: The type of incident or issue being reported.
Organize Output: Finally, it organizes the output to display the extracted information along with other relevant fields like Level, ActivityStatus, and SubscriptionId. This makes it easier to review and follow up on these notifications.

Overall, this query helps in monitoring and responding to Azure Service Health notifications by extracting and organizing key details for operational use.

KQL Search