0
votes

I am trying to query for the Monitor Condition of Fired across all my existing V2 alerts in my Azure subscription. I can use either the Az PS module, the Azure REST API, or the Azure CLI. Ideally, I'd like to just leverage Get-AzAlert and pass the Alert ID in the AlertId parameter. However, it seems to want the ID GUID. Every command I find for pulling down a list of alerts provides only the complete ARM ID, for example "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupId}/providers/microsoft.insights/metricAlerts/{alertName}".

Similarly, in the Microsoft.AlertsManagement API, there is a command available to get the alert, https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.AlertsManagement/alerts/{alertId}?api-version=2018-05-05, but it also requires the alertId in GUID form.

I could leverage a more generic call in either the PS module (Get-AzAlert leveraging the MonitorCondition parameter) or API (https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.AlertsManagement/alerts?api-version=2018-05-05) that will provide me with all alerts with a Monitor Condition of Fired, however, the respective calls are limited in scope to returning events from only the last 30 days. I need to be able to find unresolved alerts that fired more than 30 days ago.

I need a way to get the list of alert GUIDs so that I can pass those into the calls to check on the alert monitor condition.

1

1 Answers

0
votes

You can not access the alert more than 30 days ago, this is a built-in limitation. No matter you use the REST API, PowerShell or CLI, because the PowerShell and CLI both call the REST API essentially. Also, you cannot access that even if in the Azure portal, you can just specify the Time range within the past 30 days.

Reference - https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-overview#alerts-experience

enter image description here