Azure Monitor Alerts using webhook to Microsoft Teams - No messages to Teams

Question

I'm using Azure Monitor/Log Analytics to trigger alerts successfully. I'm trying to get the alerts into a Microsoft Teams channel (as well as a slack channel for debugging) with no success.

I've an alert that's successfully being triggered. I have an action group with my email, sms and azure app push configured. I've been receiving these messages each time the alert triggers.

I've got another action group with a couple of webhooks in for a Microsoft Teams and Slack channels. I'm not receiving anything on these channels.

I've enabled the custom 'Include custom Json payload for webhook' and pasted both the suggested json and the following { "AlertName":"#alertrulename", "AlertDescription":"#description", "LinkToSearchResults":"#linktosearchresults"}

I get the emails/sms/push notifications but not the messages to the web hooks. I've tried leaving the common alert schema set to no in the action group, the default (as well trying unsuccessfully on yes as well).

Suspecting it's something to do with the custom payload json as mention here https://azure.microsoft.com/en-gb/blog/webhooks-for-azure-alerts/

Any ideas on how I can get my alerts into teams?

Thanks

Could you please take a look at Webhooks with Azrure devOps server? — Trinetra-MSFT
oh my bad. May be this can help you Webhook action for log alert rules — Trinetra-MSFT

John Fox John Fox · Accepted Answer · 2020-02-06T13:35:19

Managed to crack it and get it working everyone!

Using Azure Automation, a runbook/webhook.

Added the following as a runbook (update your uri):

param
(
    [Parameter (Mandatory=$false)]
    [object] $WebhookData
)
if ($WebhookData)
{
    # Get the data object from WebhookData.
    $WebhookBody = (ConvertFrom-Json -InputObject $WebhookData.RequestBody)
    $alertName = $WebhookBody.alertname
    $alertDescription = $WebhookBody.alertDescription
    $linkToSearch = $WebhookBody.linktosearchresults
    $query = $WebhookBody.searchquery
    $results = $WebhookBody.resultcount
    $AlertThreshold = $WebhookBody.AlertThreshold
    $AlertThresholdValue = $WebhookBody.AlertThresholdValue
    $StartTime = $WebhookBody.SearchStartTime
    $EndTime = $WebhookBody.SearchEndTime
    $formatLink = "[Link]($linkToSearch)"
    $formatMessage = "$alertName has exceeded the threshold $AlertThreshold $AlertThresholdValue. Results returned: $results"

    $uri = 'https://teams-connector-uri'

    $body = ConvertTo-Json -Depth 4 @{
    summary = $alertName
    sections = @(
        @{
            activityTitle = $alertName
            activitySubtitle = $alertDescription
            activityText =  $formatMessage           
        },
        @{
            title = 'Details'
            facts = @(
                @{
                name = 'Query time range. (UTC)'
                value = "$StartTime $EndTime"
                },
                @{
                name = 'Link to search results'
                value = $formatLink
                },
                @{
                name = 'Query Executed'
                value = $query
                }
            )
        }
    )
} 
    Invoke-RestMethod -uri $uri -Method Post -body $body -ContentType 'application/json'
}

Then generate a webhook for the runbook and add this into the Azure Alert.

In the azure alert i've set the custom payload to this:

{ "AlertName":"#alertrulename", "AlertDescription":"#description", "LinkToSearchResults":"#linktosearchresults"}

Bingo, triggered alert and alert came through

Azure Monitor Alerts using webhook to Microsoft Teams - No messages to Teams

6 Answers