# Azure Activity Logs

## In ilert: Create an Azure Alerts alert source <a href="#in-ilert" id="in-ilert"></a>

1. Go to **Alert sources** --> **Alert sources** and click on **Create new alert source**

   <figure><img src="https://4017197022-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M76ygPnS4HUcFSX8ulm%2Fuploads%2FjX0cS4q7woTXKajZmc1W%2FScreenshot%202023-08-28%20at%2010.21.10.png?alt=media&#x26;token=8ef3666b-84eb-4b51-abee-f07303313941" alt=""><figcaption></figcaption></figure>
2. Search for **Azure Alerts** in the search field, click on the Azure Alerts tile and click on **Next**.&#x20;

   <figure><img src="https://4017197022-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M76ygPnS4HUcFSX8ulm%2Fuploads%2FlXzQlJpaTFSR49AZk0xA%2FScreenshot%202023-08-28%20at%2010.24.23.png?alt=media&#x26;token=cffeacb4-57b9-47d4-827d-b0f6b1afd914" alt=""><figcaption></figcaption></figure>
3. Give your alert source a name, optionally assign teams and click **Next**.
4. Select an **escalation policy** by creating a new one or assigning an existing one.

   <figure><img src="https://4017197022-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M76ygPnS4HUcFSX8ulm%2Fuploads%2FNnuZqONaIhbOf6fn4OkZ%2FScreenshot%202023-08-28%20at%2011.37.47.png?alt=media&#x26;token=8a74f7b5-5bd2-4eea-97fa-1c1dbb041333" alt=""><figcaption></figcaption></figure>
5. Select you [Alert grouping](https://docs.ilert.com/alerting/configure-alerting/alert-sources#alert-grouping) preference and click **Continue setup**. You may click **Do not group alerts** for now and change it later.&#x20;

<figure><img src="https://3394882078-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M76ygPnS4HUcFSX8ulm%2Fuploads%2FueugN4JgHn1c90ggFA6u%2FScreenshot%202023-08-28%20at%2011.38.24.png?alt=media&#x26;token=b8009daf-3ca8-4264-a6fa-e42ef7333205" alt=""><figcaption></figcaption></figure>

6. The next page show additional settings such as customer alert templates or notification prioritiy. Click on **Finish setup** for now.
7. On the final page, an API key and / or webhook URL will be generated that you will need later in this guide.

   <figure><img src="https://3394882078-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M76ygPnS4HUcFSX8ulm%2Fuploads%2Fi3TIOBvNYBQfDtNpmm0A%2FScreenshot%202023-08-28%20at%2011.47.34.png?alt=media&#x26;token=6cae965a-e448-4443-8c20-37cf501c43b2" alt=""><figcaption></figcaption></figure>

## In Azure: Create an alert <a href="#in-splunk" id="in-splunk"></a>

1. Go to [**Azure Portal**](https://portal.azure.com) and then to **Activity log.**

![](https://3394882078-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M76ygPnS4HUcFSX8ulm%2F-MUs20k1NsCA1RozKcNe%2F-MUs2dG5YTuORORLCaSr%2FHome_-_Microsoft_Azure.png?alt=media\&token=e3131fb1-5135-4284-a6cf-5acd721463f1)

2. Find and click on the activity log for which you’d like to create an alert.

![](https://3394882078-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M76ygPnS4HUcFSX8ulm%2F-MUs20k1NsCA1RozKcNe%2F-MUs3jzKHgJLGceBkTYr%2FActivity_log_-_Microsoft_Azure.png?alt=media\&token=26c931f9-4ce9-4ece-b9e7-546ae2bee1ea)

3. On the modal window click on the **New alert rule** button\*\*.\*\*

![](https://3394882078-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M76ygPnS4HUcFSX8ulm%2F-MUs3qQxLS9PdC5G3O0P%2F-MUs4EcYhUKrJhitYzNN%2FDelete_action_group_-_Microsoft_Azure.png?alt=media\&token=e28d02a7-87ef-40cc-aefc-5082cf3c7f93)

4. On the next page change the **Condition** for the alerts and click on the **Add action groups.**

![](https://3394882078-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M76ygPnS4HUcFSX8ulm%2F-MUrt7CW11sZPGpnMQgW%2F-MUrz5DM-OOOEqFWQ5p6%2FCreate_alert_rule_-_Microsoft_Azure.png?alt=media\&token=2ccb24b1-45ca-455a-863c-2def192db2b0)

5. On the modal window click on the **Create action group** button.

![](https://3394882078-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M76ygPnS4HUcFSX8ulm%2F-MUrt7CW11sZPGpnMQgW%2F-MUrytYBsLA9xOyEXXhf%2FSelect_an_action_group_to_attach_to_this_alert_rule_-_Microsoft_Azure.png?alt=media\&token=52b6faa9-2d81-4674-9748-1348137b40d1)

6. On the next page name the group e.g. **iLert** and click on the **Actions** tab.

![](https://3394882078-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M76ygPnS4HUcFSX8ulm%2F-MUrt7CW11sZPGpnMQgW%2F-MUrzHdFQ71ZG-e1Lytu%2FCreate_action_group_-_Microsoft_Azure.png?alt=media\&token=902e5c5e-cd99-4ec5-8e5e-c70b2bafcd50)

7. **\*\*On the** Actions **tab**, **click on the** Action type **and choose** Webhook.\*\*

![](https://3394882078-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M76ygPnS4HUcFSX8ulm%2F-MUs-3NneMCV63HhUv4P%2F-MUs-9HcqMGv7V2dBj3L%2FCreate_action_group_-_Microsoft_Azure.png?alt=media\&token=93c53cbe-bb6f-417b-9565-45a724d58042)

8. **On the modal window** in the **URI** section and **\*\*paste the** Webhook URL **that you generated in ilert and click on** OK\*\*. Name the action e.g.\*\* ilert **and click on the** Review + create\*\* button.

![](https://3394882078-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M76ygPnS4HUcFSX8ulm%2F-MUs-3NneMCV63HhUv4P%2F-MUs-MTqwKn3OxuQdT7f%2FWebhook_-_Microsoft_Azure.png?alt=media\&token=513a3a5c-5f48-4b04-ab38-09d6d760d03d)

9. On the next page click on the **Create** button.

![](https://3394882078-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M76ygPnS4HUcFSX8ulm%2F-MUs0ngk7rtVR9vECR9c%2F-MUs1Lp75Hu3_u5tvC4N%2FCreate_action_group_-_Microsoft_Azure.png?alt=media\&token=2454f6b0-2daf-4c67-a2fc-730252fd311f)

10. On the next page scroll down to the **Alert rule details** section, name the alert rule and click on the **Create alert rule** button.

![](https://3394882078-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M76ygPnS4HUcFSX8ulm%2F-MUs1NhnzuQ6D-otAXCU%2F-MUs1ak-gbcS9hBJUmvc%2FCreate_alert_rule_-_Microsoft_Azure1.png?alt=media\&token=91e809dc-b347-4db2-9dd8-d64495f1fd07)

11. Finished! Your Azure Activity Logs alerts will now create alerts in ilert.

## FAQ <a href="#faq" id="faq"></a>

**Will alerts in ilert be resolved automatically?**

No, unfortunately Azure Sentinel alert do not fire resolve events.

**Can I connect Azure Alerts with multiple alert sources from ilert?**

Yes, simply create more alert rules in Azure Alerts