Azure全告警安全自动化部署：alertSettings参数取值咨询

你遇到的问题根源是alertSettings参数的格式不符合模板定义的结构要求，模板中该参数是object类型，内部需包含alertSeverityMapping数组来定义告警级别匹配规则，而非简单的字符串或错误格式对象。

正确的alertSettings参数格式示例 #

如果需要匹配高、中等级别的告警，参数配置如下：

{
  "alertSettings": {
    "alertSeverityMapping": [
      {
        "jpath": "Properties.Severity",
        "expectedValue": "High",
        "operator": "Equals",
        "severity": "High"
      },
      {
        "jpath": "Properties.Severity",
        "expectedValue": "Medium",
        "operator": "Equals",
        "severity": "Medium"
      }
    ]
  }
}

若要匹配所有级别告警，只需补充Low和Informational的规则条目：

{
  "alertSettings": {
    "alertSeverityMapping": [
      {
        "jpath": "Properties.Severity",
        "expectedValue": "High",
        "operator": "Equals",
        "severity": "High"
      },
      {
        "jpath": "Properties.Severity",
        "expectedValue": "Medium",
        "operator": "Equals",
        "severity": "Medium"
      },
      {
        "jpath": "Properties.Severity",
        "expectedValue": "Low",
        "operator": "Equals",
        "severity": "Low"
      },
      {
        "jpath": "Properties.Severity",
        "expectedValue": "Informational",
        "operator": "Equals",
        "severity": "Informational"
      }
    ]
  }
}

参数字段说明 #

• jpath：指定Azure告警JSON中严重级别字段的路径，固定为Properties.Severity即可
• expectedValue：要匹配的告警级别有效值（可选：High/Medium/Low/Informational）
• operator：匹配逻辑操作符，这里使用Equals即可满足级别匹配需求
• severity：与expectedValue保持一致，用于生成自动化规则中的级别匹配条件

之前配置无效的原因 #

• 直接传入High/Medium这类字符串：不符合模板定义的object类型要求
• 使用{"alertsettings":"null"}：字段名拼写错误（应为alertSettings）且结构缺失alertSeverityMapping核心数组

内容的提问来源于stack exchange，提问作者PRAJITH