Question

A financial services company runs a critical payment API on Azure App Service. The security team needs to be automatically notified within minutes whenever more than 50 failed authentication attempts from a single client IP occur within a 5-minute window, based on the application's HTTP logs already flowing into a Log Analytics workspace. The solution must minimize custom infrastructure and support complex correlation logic across log records. Which monitoring approach should you recommend?

Accepted Answer

Create a scheduled query (log search) alert rule in Azure Monitor that runs a KQL query against the Log Analytics workspace and triggers an action group.

Answer

Create a metric alert rule in Azure Monitor using the App Service platform metric for HTTP 401 responses with a static threshold.

Answer

Configure an Activity Log alert to fire when authentication failures are recorded in the subscription Activity Log.

Answer

Deploy an Azure Function on a timer trigger that queries the workspace with the Log Analytics API and sends email via SendGrid.