# Azure Monitor

EvoHub receives Azure Monitor alerts through a **Webhook** action in an action group, using the **common alert schema**. A fired alert opens an EvoHub alert, and the resolved notification resolves it.

## Set it up

:::steps
### Create the integration
In EvoHub, go to **On-Call → Integrations → + Add Integration**, choose **Azure Monitor**, pick an **Escalation Policy** and click **Create Integration**. Copy the **Webhook URL**.
### Open an action group
In Azure Monitor, go to **Alerts → Action groups** and create or edit one.
### Add a webhook action
Add an action of type **Webhook**. Set **URI** to your webhook URL and **Enable common alert schema** to **Yes**.

```text
https://evohub.io/ingest/azuremonitor?key=YOUR_INTEGRATION_KEY
```
### Attach the action group
Attach the action group to the alert rules that should page.
:::

> [!WARNING]
> **Enable common alert schema** must be **Yes**. EvoHub refuses any other payload with `400 INVALID_SCHEMA` and the message "enable 'common alert schema' on the Azure action group".

## Turn on auto-resolve

No extra setup is needed. When Azure Monitor sends the alert with `monitorCondition: Resolved`, EvoHub resolves the matching alert. If an alert rule never sends a resolved notification, its alerts stay open until someone resolves them in EvoHub.

## What EvoHub reads

EvoHub reads the `data.essentials` part of the common alert schema:

| EvoHub alert | Taken from |
| --- | --- |
| Title | `alertRule` (or "Azure Monitor Alert"). |
| Description | `description`. A metric alert without one says what crossed what, from `alertContext`, for example "Percentage CPU is 31.1 (GreaterThan 25)". |
| Labels | `severity` (as Azure sends it, for example `Sev1`) and `resource`, the first of `configurationItems`, plus the action group's `customProperties`. |
| Link | `investigationLink` when Azure sends it, else a log search alert's link to its results. It opens from the alert. |
| Values | A metric alert's `metric`, `metric_value` and `threshold`. |
| Fingerprint | `alertId` (or, if it is missing, the alert rule name). |

### Severity

| Azure severity | EvoHub severity |
| --- | --- |
| Sev0 | critical |
| Sev1 | high |
| Sev2 | medium |
| Sev3 | low |
| Sev4 | info |
| anything else | medium |

## Resolve and deduplication

- `monitorCondition: Resolved` resolves the open alert with the same `alertId`. Any other condition, such as **Fired**, opens an alert.
- Another notification for the same `alertId` while its alert is open is recorded as **Retriggered**.

## Troubleshooting

- **`400 INVALID_SCHEMA`**: the action group sends the legacy schema. Turn on **Enable common alert schema** for the webhook action.
- **`401 INVALID_KEY`**: the URL's key is wrong or the integration is disabled. Copy the **Webhook URL** again from the integration.
- **Nothing arrives**: check that the action group is attached to the alert rule and that the webhook action is the one with your URL.

## Related

- [Integrations overview](https://docs.evohub.io/integrations-overview.md)
- [Google Cloud Monitoring](https://docs.evohub.io/google-cloud-monitoring.md)
- [Escalation policies](https://docs.evohub.io/escalation-policies.md)