添加 SQL 防火墙规则时的 Azure 警报

Question

有没有办法在 firewall rule is added to an Azure SQL database 时收到警报？我检查了监控 Blade ，没有看到这方面的指标或日志事件。

Answer 1

您可以使用逻辑应用来实现此目的:

1. 使用“收到 HTTP 请求时”模板创建新的逻辑应用。使用以下 JSON 作为示例负载。然后您需要添加条件和操作(电子邮件？)。在电子邮件正文中，您可以发送更多详细信息，例如调用者电子邮件、调用者 IP 等。

条件应为“Status=Activated”且“OperationName”=“Microsoft.Sql/servers/firewallRules/write”。 2. 在监视器中创建新警报。资源将是您的 SQL Server，信号将是“所有管理操作”。创建一个新的操作组并设置 webhook 操作。使用上一步中生成的逻辑应用 Webhook url。

{
    "headers": {
        "Connection": "Keep-Alive",
        "Expect": "100-continue",
        "Host": "abc.logic.azure.com",
        "User-Agent": "IcMBroadcaster/1.0",
        "X-CorrelationContext": "abc",
        "Content-Length": "1350",
        "Content-Type": "application/json; charset=utf-8"
    },
    "body": {
        "schemaId": "Microsoft.Insights/activityLogs",
        "data": {
            "status": "Activated",
            "context": {
                "activityLog": {
                    "channels": "Operation",
                    "eventSource": "Administrative",
                    "eventTimestamp": "2019-03-09T10:00:36.549+00:00",
                    "eventDataId": "eventid",
                    "level": "Informational",
                    "operationName": "Microsoft.Sql/servers/firewallRules/write",
                    "properties": {
                        "originalEventTimestamp": "03/09/2019 10:00:17",
                        "correlationId": "correlationId",
                        "eventId": "eventId",
                        "eventName": "OverwriteFirewallRules",
                        "operationName": "Microsoft.Sql/servers/firewallRules/write",
                        "status": "Succeeded",
                        "description_scrubbed": "description",
                        "caller": "<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="14616771667179757d78547179757d783a777b79" rel="noreferrer noopener nofollow">[email protected]</a>",
                        "callerCredentialType": "LiveId",
                        "eventChannel": "OperationLogStore",
                        "ipAddress": "useripaddress",
                        "eventSource": "SQL Databases Event Supplier"
                    },
                    "resourceId": "resourceId",
                    "resourceGroupName": "groupname",
                    "resourceProviderName": "MICROSOFT.SQL",
                    "status": "Succeeded",
                    "subscriptionId": "subscriptionId",
                    "submissionTimestamp": "2019-03-09T10:00:36.549+00:00",
                    "resourceType": "microsoft.sql/servers"
                }
            },
            "properties": {}
        }
    }
}