Question

You manage 30 Azure VMs that send performance data to a Log Analytics workspace via the Azure Monitor Agent. The security team wants to be notified whenever the Windows Event log records more than five failed logon events (Event ID 4625) within a 10-minute window on any monitored VM. You need to create an alert rule that meets this requirement with the least administrative effort. What should you configure?

Accepted Answer

A log search alert rule with a KQL query against the Event table, evaluated every 10 minutes with a threshold of 5

Answer

A metric alert rule using the platform metric 'Available Memory Bytes' scoped to all 30 VMs

Answer

An activity log alert rule filtered on the 'Security' category for the resource group containing the VMs

Answer

A metric alert rule with a dynamic threshold applied to guest OS metrics collected by the agent