Actionable alerts

This tile breaks down alerts by severity to provide a simple proxy metric for actionability. This query analyzes Azure alert events using the SQL Analytics feature, and classifies them into actionable and non-actionable categories based on alert severity.

It groups alerts using a simple severity-based rule, treating Sev1 and Sev2 alerts as likely to require action and Sev3 and Sev4 alerts as noise candidates.

By comparing high-severity alerts to lower-severity noise, you can easily understand whether your alerting strategy is focused on issues that are likely to require intervention, or dominated by alerts that rarely demand action.

Configuration

Configure the following in the tile editor:

1. Data source: Select Azure.
2. Data stream: Select Alerts.
3. Objects: Select the monitored objects you want to track alerts for.
4. Parameters:
   1. Monitor condition: Select Fired.
   2. Severity: Leave blank to capture every severity level.
5. Filter | Group | Sort: Enable the SQL toggle then enter the following query and click Execute:
   
   Copy

   SELECT
     CASE
       WHEN "properties.essentials.severity" IN ('Sev1', 'Sev2') THEN 'Actionable'
       WHEN "properties.essentials.severity" IN ('Sev3', 'Sev4') THEN 'Non-actionable'
       ELSE 'Unknown'
     END AS actionability,
     COUNT(*) AS alert_count
   FROM dataset1
   GROUP BY 1
   ORDER BY alert_count DESC;

6. Visualization:
   1. Type: Select Bar.
   2. Mapping:
      1. X-Axis: Select Actionability.
      2. Y-Axis: Select Alert Count.
   3. Type > Layout: Select Horizontal.
7. Click Save.

Was this article helpful?