Scheduled query rule should be enabled

High Azure General scheduledqueryrules-scheduled-query-rule-enabled

Applies to

Microsoft.Insights/scheduledQueryRules

What CGPulse checks

A resource passes this rule when enabled must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable the scheduled query rule to ensure alert monitoring is active. In Azure Portal: Monitor > Alerts > select rule > enable. See: https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-create-log-alert-rule

CLI

az monitor scheduled-query update --ids "{id}" --disabled false

Terraform

resource "azurerm_monitor_scheduled_query_rules_alert_v2" "{name}" {
  name                = "{name}"
  resource_group_name = "{rg}"
  location            = var.location
  enabled             = true
  scopes              = ["<resource-id>"]
  evaluation_frequency = "PT5M"
  window_duration      = "PT5M"
  severity             = 3
  criteria {
    query                   = "<kql-query>"
    time_aggregation_method = "Count"
    operator                = "GreaterThan"
    threshold               = 0
  }
}

Compliance frameworks

Cloud Security: Azure Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan