# you can disable an alarm notification by setting the 'to' line to: silent

# --- Errors: Failed Requests ---

# helper: total requests over 5m (no alarm, value only)
 template: am_appgw_total_requests
       on: azure_monitor.application_gateway.requests
    class: Workload
     type: Web Server
component: Application Gateway
   lookup: sum -5m unaligned of total
    units: requests/s
    every: 1m
     info: Total requests on Application Gateway ${label:resource_name}

# failed request ratio — fires only when traffic is meaningful
 template: am_appgw_failed_requests
       on: azure_monitor.application_gateway.requests
    class: Errors
     type: Web Server
component: Application Gateway
   lookup: sum -5m unaligned of failed
     calc: ($am_appgw_total_requests > 10) ? ($this * 100 / $am_appgw_total_requests) : (0)
    units: %
    every: 1m
     warn: $this > (($status >= $WARNING)  ? (5)  : (10))
     crit: $this > (($status == $CRITICAL) ? (10) : (25))
    delay: down 5m multiplier 1.5 max 1h
  summary: App Gateway failed requests on ${label:resource_name}
     info: Percentage of failed requests on Application Gateway ${label:resource_name} \
           in ${label:resource_group} (${label:region})
       to: sysadmin

# --- Availability: Backend Health ---

 template: am_appgw_unhealthy_hosts
       on: azure_monitor.application_gateway.backend_health
    class: Errors
     type: Web Server
component: Application Gateway
   lookup: average -5m unaligned of unhealthy
    units: hosts
    every: 1m
     warn: $this > (($status >= $WARNING)  ? (0) : (1))
     crit: $this > (($status == $CRITICAL) ? (1) : (2))
    delay: down 5m multiplier 1.5 max 1h
  summary: App Gateway unhealthy backends on ${label:resource_name}
     info: Unhealthy backend hosts on Application Gateway ${label:resource_name} \
           in ${label:resource_group} (${label:region})
       to: sysadmin

# --- Latency: Backend Connect Time ---

 template: am_appgw_backend_connect_time
       on: azure_monitor.application_gateway.backend_latency
    class: Latency
     type: Web Server
component: Application Gateway
   lookup: average -5m unaligned of connect
    units: milliseconds
    every: 1m
     warn: $this > (($status >= $WARNING)  ? (100) : (250))
     crit: $this > (($status == $CRITICAL) ? (250) : (500))
    delay: down 5m multiplier 1.5 max 1h
  summary: App Gateway backend connect time on ${label:resource_name}
     info: Average backend connection time on Application Gateway ${label:resource_name} \
           in ${label:resource_group} (${label:region})
       to: sysadmin

# --- Latency: Backend First Byte ---

 template: am_appgw_backend_first_byte
       on: azure_monitor.application_gateway.backend_latency
    class: Latency
     type: Web Server
component: Application Gateway
   lookup: average -5m unaligned of first_byte
    units: milliseconds
    every: 1m
     warn: $this > (($status >= $WARNING)  ? (2000) : (4000))
     crit: $this > (($status == $CRITICAL) ? (4000) : (8000))
    delay: down 5m multiplier 1.5 max 1h
  summary: App Gateway backend TTFB on ${label:resource_name}
     info: Average backend time to first byte on Application Gateway ${label:resource_name} \
           in ${label:resource_group} (${label:region})
       to: sysadmin

# --- Latency: Total Client Request Time ---

 template: am_appgw_total_time
       on: azure_monitor.application_gateway.client_latency
    class: Latency
     type: Web Server
component: Application Gateway
   lookup: average -5m unaligned of total_time
    units: milliseconds
    every: 1m
     warn: $this > (($status >= $WARNING)  ? (3000) : (5000))
     crit: $this > (($status == $CRITICAL) ? (5000) : (10000))
    delay: down 5m multiplier 1.5 max 1h
  summary: App Gateway total request time on ${label:resource_name}
     info: Average total client request time on Application Gateway ${label:resource_name} \
           in ${label:resource_group} (${label:region})
       to: sysadmin

# --- Utilization: CPU ---

 template: am_appgw_cpu_utilization
       on: azure_monitor.application_gateway.cpu
    class: Utilization
     type: Web Server
component: Application Gateway
   lookup: average -5m unaligned of average
    units: percentage
    every: 1m
     warn: $this > (($status >= $WARNING)  ? (75) : (85))
     crit: $this > (($status == $CRITICAL) ? (85) : (95))
    delay: down 5m multiplier 1.5 max 1h
  summary: App Gateway CPU utilization on ${label:resource_name}
     info: CPU utilization on Application Gateway ${label:resource_name} \
           in ${label:resource_group} (${label:region})
       to: sysadmin

# --- Errors: WAF Blocked Request Ratio ---

# helper: total WAF requests over 5m (no alarm, value only)
 template: am_appgw_waf_total_requests
       on: azure_monitor.application_gateway.waf_requests
    class: Workload
     type: Web Server
component: Application Gateway
   lookup: sum -5m unaligned of total
    units: requests/s
    every: 1m
     info: Total WAF requests on Application Gateway ${label:resource_name}

# WAF blocked ratio — fires only when WAF has meaningful traffic
 template: am_appgw_waf_blocked_ratio
       on: azure_monitor.application_gateway.waf_requests
    class: Errors
     type: Web Server
component: Application Gateway
   lookup: sum -5m unaligned of blocked
     calc: ($am_appgw_waf_total_requests > 10) ? ($this * 100 / $am_appgw_waf_total_requests) : (0)
    units: %
    every: 1m
     warn: $this != nan AND $this > (($status >= $WARNING) ? (25) : (50))
    delay: down 5m multiplier 1.5 max 1h
  summary: App Gateway WAF block ratio on ${label:resource_name}
     info: Percentage of requests blocked by WAF on Application Gateway ${label:resource_name} \
           in ${label:resource_group} (${label:region}). \
           High values may indicate an attack or WAF misconfiguration
       to: sysadmin