Examkin

Question

Difficulty: HardAzure Monitor Alerts and Action Groups

You are implementing a monitoring solution in Azure. You configure an Azure Monitor metric alert to monitor the CPU usage of a critical database virtual machine. When the CPU usage exceeds 90%, the alert must send a notification to a third-party ticketing system's REST API endpoint. The ticketing system's API accepts JSON payloads but requires a custom schema with specific fields (such as 'ticket_priority' and 'source_device') that do not match the default Azure Monitor alert schema or the Common Alert Schema. You need to implement a solution that transforms the alert payload into the required format and forwards it to the API, while minimizing administrative effort and avoiding custom code maintenance. Which of the following is the best solution to meet this requirement?

  1. Route the alert to an Azure Logic App by using the Logic App action in the action group, and configure the workflow to parse the alert JSON, map it to the custom schema, and call the REST API.Answer
  2. B
    Modify the webhook action in the action group to use a custom JSON payload template that maps the Azure Monitor schema to the third-party schema.
  3. C
    Create an alert processing rule with a custom action to rewrite the alert payload properties before the action group is executed.
  4. D
    Configure the webhook action in the action group to use the Common Alert Schema, and define the required custom fields in the Custom HTTP Headers section of the webhook configuration.

Answer

Route the alert to an Azure Logic App by using the Logic App action in the action group, and configure the workflow to parse the alert JSON, map it to the custom schema, and call the REST API.
The correct option is to route the alert to an Azure Logic App. Logic Apps provide a built-in trigger for Azure Monitor alerts and visual tools to parse and map the alert JSON payload into the specific schema required by the third-party API, all without writing or maintaining custom code. This represents the lowest administrative effort and satisfies all constraints.

Step-by-Step Solution

1
Analyze Azure Monitor Action Group capabilities for payload customization.
Confirm that Webhook actions in Azure Monitor only support the legacy schema and the Common Alert Schema, and do not allow custom JSON body transformation or templating.
This establishes that direct configuration inside the Action Group cannot satisfy the custom payload requirement.
2
Evaluate the capabilities of Azure Logic Apps for this scenario.
Determine that Logic Apps have built-in HTTP request triggers, a JSON parsing action, and an HTTP action to call external APIs, allowing payload restructuring without custom code.
This confirms that Logic Apps provide a low-admin, low-code solution that avoids custom code maintenance (unlike custom Azure Functions or Automation runbooks).
3
Select the correct integration method in the Action Group.
Configure the Action Group to use the native Logic App action, which triggers the workflow whenever the alert fires.
Using the native Logic App action simplifies the configuration and ensures reliable triggering.

Key Concept

Azure Monitor Action Groups support various action types, but they cannot customize or rewrite the JSON payload of an alert directly. For custom schema mapping, an intermediary service like Azure Logic Apps should be used to parse, transform, and forward the payload to third-party APIs.
Rate this question

Topics

Azure Monitor Alerts and Action Groups

More questions from this topic